Sanitize file names and escape file links

[Saggre]

Summary

Fixes missing sanitization and escaping for uploaded file names and URLs in the advanced form AJAX handler and email notification template.

Changes

includes/advanced-form/advanced-form-ajax.php

• Wrap uploaded file names with sanitize_file_name() before collecting them into $file_name_array. Previously the raw $file['name'] value from $_FILES was used without sanitization.

includes/templates/form-email.php

• Escape file attachment URLs with esc_url() inside anchor href attributes.
• Escape file names with esc_html() inside anchor link text.

Why

Uploaded file names originate from user-controlled input via $_FILES.

Checklist

• I have performed a self-review.
• No unrelated files are modified.
• No debugging statements exist (Ex: console.log, error_log).
• There are no warnings or notices in the wordpress error log.
• Passes all tests (linting, acceptance, & unit)