Harden invitee input and contact names

Security audit found two gaps. Sabre only quotes ICS
parameter values containing space, newline, quote, colon,
semicolon, caret, comma or plus, so a bare carriage
return in a contact name would be written into the
serialized event unquoted and break the line structure;
names with control characters are now dropped. The raw
attendee input and the search query had no length
bound, a huge POST field was fully split, iterated and
echoed back on re-render, a cheap CPU sink; both are
now capped, the query at the longest possible email
fragment.

tests/Unit/CalendarControllerTest.php

@@ -933,6 +933,16 @@ class CalendarControllerTest extends TestCase
         $this->invoke($c, 'parseAttendees', ['alice@example.com,not-an-email']);
     }
 
+    public function testParseAttendeesRejectsOversizedInput(): void
+    {
+        $c = $this->newController();
+
+        $this->expectException(\InvalidArgumentException::class);
+        $this->expectExceptionMessage('Invitee list is too long.');
+
+        $this->invoke($c, 'parseAttendees', [str_repeat('x', 6000)]);
+    }
+
     public function testParseAttendeesEnforcesLimit(): void
     {
         $c = $this->newController();
@@ -1045,4 +1055,42 @@ class CalendarControllerTest extends TestCase
 
         $this->assertCount(50, $response->getData());
     }
+
+    public function testSearchContactsTruncatesQuery(): void
+    {
+        $this->contactsManager->expects($this->once())->method('search')
+            ->willReturnCallback(
+                static function (string $query): array {
+                    return strlen($query) <= 254
+                        ? [['FN' => 'Alice', 'EMAIL' => 'alice@example.com']]
+                        : [];
+                }
+            );
+
+        $c = $this->newController();
+
+        $response = $c->searchContacts(str_repeat('a', 300));
+
+        $this->assertSame(
+            [['email' => 'alice@example.com', 'name' => 'Alice']],
+            $response->getData()
+        );
+    }
+
+    public function testContactSuggestionsDropControlCharNames(): void
+    {
+        $this->contactsManager->method('search')->willReturn([
+            ['FN' => "Evil\rName", 'EMAIL' => 'evil@example.com'],
+            ['FN' => 'Alice', 'EMAIL' => 'alice@example.com'],
+        ]);
+
+        $c = $this->newController();
+
+        $suggestions = $this->invoke($c, 'contactSuggestions', ['']);
+
+        $this->assertSame([
+            ['email' => 'evil@example.com', 'name' => ''],
+            ['email' => 'alice@example.com', 'name' => 'Alice'],
+        ], $suggestions);
+    }
 }