Fix reflected XSS in composer mygraph view

[Copilot]

The /composer/mygraph endpoint reflected user-supplied action and graphName query parameters directly into HTTP responses without HTML escaping, enabling reflected XSS attacks:

/composer/mygraph?action="><script>alert(1)</script>&graphName=test
/composer/mygraph?action=delete&graphName="><script>alert(1)</script>

Changes

• webapp/graphite/composer/views.py: Apply django.utils.html.escape() to action and graphName in all error response strings
• webapp/tests/test_xss.py: Add ComposerMyGraphXSSTest with coverage for both vulnerable parameters

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.