OpenBK7231T vulnerabilities

OpenBK7231T's http_fn_ota_exec() reflects the `host` query parameter directly into an HTML response without HTML encoding, allowing JavaScript execution in an authenticated admin's browser when they click a malicious link.

The CHANNEL_SetLabel function in OpenBK7231T stores channel labels received via the MQTT SetChannelLabel command using strdup with no HTML sanitization. CHANNEL_GetLabel returns these labels unsanitized, and they are rendered via hprintf255 at 15+ locations in src/httpserver/http_fns.c with no HTML encoding.

OpenBK7231T's /cfg_wifi_set endpoint accepts configuration changes via a plain GET request with no CSRF token. If the parameter is absent from the request, an else-branch silently clears the device's web admin password to an empty string.