msg: sanitize term title and block C1 controls and DEL

Expose the terminal output sanitizer as mp_msg_sanitize() and use it in
term_osd_update_title() to sanitize the property-expanded term-title
string before it reaches mp_msg_set_term_title(). Without this, a
crafted media tag can break out of the OSC-0 sequence via embedded BEL
or ESC bytes when --term-title includes property expansions like
${media-title}.

Extend the sanitizer to cover two gaps:

- UTF-8 encoded C1 controls (U+0080-U+009F, bytes C2 80..C2 9F). xterm
  in UTF-8 mode interprets these codepoints as C1 control functions
  (U+009B as CSI, U+009D as OSC, U+009C as ST), allowing escape
  sequence injection without any ESC or BEL bytes.

- DEL (0x7F), which was not previously filtered.