[3304711297]

Problem

TokeerBridge::Redeem() builds the request body for POST /drm/redeem by concatenating
the redeem code straight into a JSON string, with no escaping:

const std::string url = TokeerBaseUrl() + "/drm/redeem";
const std::string reqBody = "{\"code\":\"" + code + "\"}";

code comes verbatim from the bst:// URL — HandleUri() splits the URL on / and
passes the remainder through unchanged:

const std::string arg = (slash == std::string::npos) ? "" : rest.substr(slash + 1);

if (action == "redeem") {
    if (!arg.empty()) Redeem(arg);

JSON requires that " inside a string value be escaped. A value containing a double
quote therefore terminates the string early and changes the structure of the request,
so such a value cannot be represented correctly. A backslash or a control character has
the same effect.

The scheme is registered in HKCU\Software\Classes\bst, so the value is reachable
from a URL handler, i.e. it is not restricted to a locally typed value.

Change

Adds a JsonEscape() helper in the same anonymous namespace as the existing
hand-rolled JSON helpers, and applies it to the value that is embedded into the
request body:

const std::string reqBody = "{\"code\":\"" + JsonEscape(code) + "\"}";

JsonEscape() escapes " and \, maps the named control escapes (\b, \f,
\n, \r, \t), and emits \u00XX for the remaining control characters, per
RFC 8259.

Scope

One file, one call site. The other JSON helper in this file (JsonString(), which
parses the response) is left as is — this change only covers the request side.

Verification

Built with MSVC 19.44 (VS 2022) in Release; TokeerBridge.cpp compiles clean.

Note for the reviewer: an unrelated pre-existing build issue in this tree surfaces
on a machine with a GBK (code page 936) system locale — Hooks_Manifest.cpp and
Dialog.h contain non-ASCII characters in comments and produce
warning C4819 plus a syntax error at Hooks_Manifest.cpp:236. It reproduces on an
unmodified checkout and is not related to this change. Building with /utf-8 clears
it.