fix: bound the %u escape write with snprintf

Sonar flagged the sprintf call added by the previous commit. The
output buffer is sized for the worst case, so this only makes the
bound explicit.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Mhspv9mxtMSiWC1U8mVH1H

Author: fzipi

apache2/msc_util.c

@@ -191,7 +191,7 @@ char *utf8_unicode_inplace_ex(apr_pool_t *mp, unsigned char *input, long int inp
         if (unicode_len > 0) {
             i += unicode_len;
             /* code points above U+FFFF need five hex digits */
-            data += sprintf(data, "%%u%04x", d);
+            data += snprintf(data, len - (data - rval), "%%u%04x", d);
             *changed = 1;
         }
         else {