Avoid eager SQLi/XSS debug input formatting

[Easton97-Jens]

Motivation

• Prevent expensive eager formatting of attacker-controlled inputs that was performed unconditionally in DetectSQLi::evaluate and DetectXSS::evaluate, which bypassed the runtime debug-level guard and could cause avoidable CPU and memory usage.

Description

• Removed the unconditional precomputation of loggable_input from src/operators/detect_sqli.cc and src/operators/detect_xss.cc to avoid always calling toHexIfNeeded on the full input.
• Inlined the call to utils::string::limitTo(80, utils::string::toHexIfNeeded(input)) directly inside the ms_dbg_a(...) message expressions so the existing lazy runtime debug-level check in ms_dbg_a prevents formatting when logging is disabled.
• Kept detection outcomes and capture behavior unchanged and limited the change to log message construction only.

Testing

• Ran git -C /workspace/ModSecurity diff --check which passed.
• Verified changed files with git -C /workspace/ModSecurity status --short and inspected the updated source with nl -ba to confirm the inlined formatting expressions were applied to DetectSQLi and DetectXSS and no other files were modified.
• Committed the changes and created the PR record with the title and body describing the fix.

---

Codex Task

[sonarqubecloud]

Quality Gate passed

Issues
5 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud