Prepare v2.1.4 security release

[LabSchool-GR]

Summary

• Restrict newly submitted update links to HTTP and HTTPS, with sensible length limits.
• Prevent legacy update records with unsafe URI schemes from rendering clickable links.
• Add noreferrer protection to external links opened in a new tab.
• Update Laravel, Guzzle, PhpSpreadsheet, and Symfony dependencies to patched releases.
• Prepare the v2.1.4 changelog and upgrade documentation.
• Configure the incremental release path from v2.1.3 to v2.1.4.
• Derive the upgrade manifest's migration requirement from the actual release diff.

Why

The update-link hardening prevents unsafe stored URL schemes from becoming clickable. The dependency refresh addresses current Composer security advisories, including issues affecting signed URLs, email validation/headers, spreadsheet processing, routing, and HTTP handling.

Impact

No database migration is required. Deployments upgrading from v2.1.3 must install the locked production Composer dependencies and clear optimized caches.

Validation

• composer validate --strict
• composer audit --locked — no known security advisories
• php artisan test — 163 passed, 786 assertions
• npm audit --omit=dev — 0 vulnerabilities
• npm run build
• git diff --check
• GitHub Actions CI
• Production smoke test after deployment

Upgrade Notes

1. Back up the database and application files.
2. Put the application in maintenance mode.
3. Apply the v2.1.3 to v2.1.4 upgrade package.
4. Run composer install --no-dev --prefer-dist --optimize-autoloader.
5. Run php artisan migrate --force (no new migration is expected).
6. Run php artisan optimize:clear, rebuild production caches as needed, and bring the application back online.
7. Smoke-test login, quiz management, student join, email, Excel/PDF exports, and signed links.