fix: address open code scanning alerts (log forging, missed Where)

[rlorenzo]

Summary

Fixes both open CodeQL code scanning alerts:

• Alert #714 (cs/log-forging, error): ScheduleEditService.cs:248 flagged string.Join(",", weekIds) flowing into a log entry. While int[] values cannot actually carry control characters, this line was previously dismissed as a false positive (alert build(deps): bump the npm_and_yarn group across 2 directories with 2 updates #117) and CodeQL re-flagged it as a new alert when the surrounding catch block changed in fix(clinical): detect duplicate schedules by SQL error number #229. Wrapping with LogSanitizer.SanitizeString() closes the taint path permanently. Applied to all four occurrences of the pattern in the file (lines 129, 248, 557, 584) so the parallel sites with dismissed alerts (Upgrade to LTS versions of .NET 10 and NodeJS 24 #120, VPR-104 fix(a11y): ClinicalScheduler, CMS, Computing, CAHFS accessibility (PR 6 of 6) #146) do not re-flag either.
• Alert #703 (cs/linq/missed-where, note): NonCrestHarvestPhase.cs:431 flagged the ApplyDirectorCustodialDeptFallback foreach whose body was a single guarding if. Moved the CRN presence and dictionary membership checks into the existing .Where() clause; the loop body now only performs the assignment. Behavior is unchanged.

Testing

• npm run lint on both files: passes (remaining CA1502 complexity warnings are pre-existing on an untouched method)
• npm run test:backend: all 2134 tests pass, including ApplyDirectorCustodialDeptFallback_InheritsDirectorDept_OnlyForNonAcademicCourses

[codecov-commenter]

Bundle Report

Bundle size has no change ✅

[codecov-commenter]

Codecov Report

❌ Patch coverage is 77.77778% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 44.67%. Comparing base (3eaecff) to head (4f0c56a).

Files with missing lines	Patch %	Lines
.../ClinicalScheduler/Services/ScheduleEditService.cs	50.00%	2 Missing ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #254   +/-   ##
=======================================
  Coverage   44.67%   44.67%           
=======================================
  Files         897      897           
  Lines       51894    51893    -1     
  Branches     4869     4868    -1     
=======================================
+ Hits        23184    23185    +1     
  Misses      28130    28130           
+ Partials      580      578    -2     

Flag	Coverage Δ
backend	44.74% <77.77%> (+<0.01%)	⬆️
frontend	43.41% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

[Copilot]

Pull request overview

This PR addresses two CodeQL alerts by (1) sanitizing weekIds values before logging to permanently close a log-forging taint path, and (2) rewriting a foreach guard-pattern into a LINQ Where() filter to satisfy the “missed where” analyzer without changing behavior.

Changes:

• Sanitize string.Join(",", weekIds) via LogSanitizer.SanitizeString(...) at all affected log sites in ScheduleEditService.
• Refactor ApplyDirectorCustodialDeptFallback to push CRN presence + dictionary membership checks into the .Where() clause and keep the loop body as a single assignment.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
web/Areas/Effort/Services/Harvest/NonCrestHarvestPhase.cs	Refactors a foreach guard if into a stronger LINQ filter and simplifies the loop body to an assignment.
web/Areas/ClinicalScheduler/Services/ScheduleEditService.cs	Sanitizes logged week-id lists with LogSanitizer.SanitizeString to resolve CodeQL log-forging alerts.