fix(security): add csrf filter + prevent xss attacks by escaping user input

- update CI4 to v4.1.9's stable production package
- update php and js dependencies to latest

app/Libraries/CommentObject.php

@@ -37,7 +37,7 @@ class CommentObject extends ObjectType
 
         $this->replies = url_to(
             'episode-comment-replies',
-            $comment->actor->username,
+            esc($comment->actor->username),
             $comment->episode->slug,
             $comment->id
         );