analyzer, cmd/capslock-git-diff: escape control characters in callpath filenames

[MusGaas]

Fixes #299.

token.Position.Filename can be set to an arbitrary string by //line and
/*line ...*/ directives in analyzed Go source. capslock copies that string
into cpb.Function_Site.Filename (after path.Base) and writes it to terminal
sinks unchanged, so a directive containing ANSI escape bytes or tabs reaches
the user's terminal.

This change escapes control characters at the three terminal-output sinks:

• analyzer/compare.go printCallPath (-output=compare)
• analyzer/static/verbose.tmpl (-output=v/-output=verbose), via a new
  escape entry in templateFuncMap
• cmd/capslock-git-diff/main.go printCallPath

The escape helper uses strconv.Quote with the surrounding "s trimmed off,
matching the existing helper in cmd/capslock/capslock.go (used since version
output was added). Legitimate Go source filenames pass through unchanged;
only non-printable bytes are escaped.

The JSON output path is not touched: protojson already escapes control
bytes, and machine consumers should keep receiving raw filenames.

cmd/capslock-git-diff does not import analyzer, so the helper is
duplicated locally rather than exported from analyzer.

Test

analyzer/util_test.go adds a unit test for escapeControlChars covering
plain filenames, filenames with spaces, ANSI CSI bytes, embedded tabs, and
BEL. It also asserts that no C0 byte or DEL remains in the output for any
case. Existing tests continue to pass.

[jcd2]

Nicely done, thanks!

This will make path separators on Windows double-backslashes, but that's ok for now.