fix(esp_event): fix format string vulnerability in esp_event_dump (SEC-064)

fprintf(file, buf) is a format-string sink: if any registered event base
or handler name contains "%", fprintf interprets it as a format directive,
causing an information leak or crash.

Replace with fprintf(file, "%s", buf) so the buffer is always treated as
plain text regardless of its content.

Closes SEC_064

components/esp_event/esp_event.c

@@ -1097,7 +1097,7 @@ esp_err_t esp_event_dump(FILE* file)
     portEXIT_CRITICAL(&s_event_loops_spinlock);
 
     // Print the contents of the buffer to the file
-    fprintf(file, buf);
+    fprintf(file, "%s", buf);
 
     // Free the allocated buffer
     free(buf);