fix: escape command data the runner writes itself (#1120)

Command data is percent-escaped on the wire because Gitea's job log cannot carry a newline, and the renderer decodes it.

1. Unescaping iterated a map, so order was random per process: `%250A` decoded to a newline instead of a literal `%0A` about two runs in three. Now a precompiled `strings.NewReplacer`.
1. Escape the data of command lines the runner writes itself (`##[error]`, `::group::Run …`), so decoding returns the original text instead of mangling a `%`. Multi-line runner errors also get real line breaks instead of a literal `\n`.
1. Register secrets in escaped form too — one containing `%` reaches the log as `%25…` and was never masked.
1. Decode in `jobLogFormatter`, so `gitea-runner exec` matches the web view.

## Relation to the Gitea PR

https://github.com/go-gitea/gitea/pull/38659 makes the renderer decode command data. Point 2 is required by it; the rest stand alone. Either order works — until both land, a new runner on old Gitea shows `%25`, an old runner on new Gitea shows the mangling point 2 fixes.
Co-authored-by: bircni <bircni@icloud.com>
Reviewed-on: https://gitea.com/gitea/runner/pulls/1120
Reviewed-by: bircni <bircni@icloud.com>
Co-authored-by: silverwind <me@silverwind.io>

act/runner/logger.go

@@ -175,6 +175,10 @@ func AppendSecretMasker(oldnew []string, v string) []string {
 		// formatted JSON secrets could otherwise mask {,[,],} everywhere
 		if len(tm) > 1 {
 			ret = append(ret, tm, "***")
+			// command data reaches the log escaped, so "pass%word" also arrives as "pass%25word"
+			if strings.ContainsAny(tm, "%\r\n") {
+				ret = append(ret, escapeCommandData(tm), "***")
+			}
 		}
 	}
 
@@ -230,6 +234,11 @@ type jobLogFormatter struct {
 func (f *jobLogFormatter) Format(entry *logrus.Entry) ([]byte, error) {
 	b := &bytes.Buffer{}
 
+	// the web renderer decodes command data, so this local view has to as well
+	if _, _, _, ok := tryParseRawActionCommand(entry.Message + "\n"); ok {
+		entry.Message = UnescapeCommandData(entry.Message)
+	}
+
 	if f.isColored(entry) {
 		f.printColored(b, entry)
 	} else {