Migrate `<c:out>` to OWASP Encoder — Phase 5: Security-sensitive cases