Fix stored XSS in Calendar name (CVE-2023-24690)

Add strip_tags() sanitization when creating new calendars to prevent
XSS payloads from being stored in the database.

This is part of CVE-2023-24690 which covers multiple XSS vulnerabilities:
- Calendar Name XSS (fixed here)
- Group Name XSS (fixed in PR #7675)
- Group Description XSS (fixed in PR #7675)

Fixes #6444

Author: DawoudIO

src/api/routes/calendar/calendar.php

@@ -193,7 +193,7 @@ function NewCalendar(Request $request, Response $response, $args): Response
 {
     $input = $request->getParsedBody();
     $Calendar = new Calendar();
-    $Calendar->setName($input['Name']);
+    $Calendar->setName(strip_tags($input['Name']));
     $Calendar->setForegroundColor($input['ForegroundColor']);
     $Calendar->setBackgroundColor($input['BackgroundColor']);
     $Calendar->save();