Migrate `<c:out>` to OWASP Encoder — Phase 2: Single-instance files