docs: add Security & Quality Conventions to copilot-instructions.md

[TheWitness]

Adds a "Security & Quality Conventions" section to .github/copilot-instructions.md, documenting recurring patterns established across the Cacti plugin fleet:

• No hardcoded third-party hosts (expose as a setting instead)
• Prepared statements over db_qstr()
• html_escape_request_var() over html_escape(get_request_var(...))
• Hardened unserialize() (allow_classes => false)
• i18n text domain on every translated string
• The api_plugin_db_table_create()/api_plugin_db_add_column() idempotent table-creation API
• The standard PHPDoc block shape (description, blank comment, @param, blank comment, @return)

Documentation-only change, no functional/behavioral changes.

[Copilot]

Copilot review overview

🟢 Approval recommended

Documentation-only change with clear, accurate guidance and no functional impact.

Review effort: Lite
Findings: None

What changed in this PR

Adds a new documentation section to the repository’s Copilot instructions, capturing recurring security and quality patterns used across the Cacti plugin fleet to help keep future contributions consistent and safer.

Changes:

• Documented key security conventions (no hardcoded hosts, prepared statements, hardened unserialize(), consistent i18n domain usage).
• Documented preferred Cacti/plugin APIs (html_escape_request_var(), idempotent plugin table-creation helpers).
• Documented a standard PHPDoc block shape to encourage consistent function documentation.

File	Description
.github/​copilot-instructions.md	Adds a “Security & Quality Conventions” section describing established secure/consistent coding patterns.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.