Escape what the monitor page renders, and put the helpers where every page can reach them

The page interpolated media titles, partner hostnames read over the mesh, and docker folder
names straight into innerHTML — its own header claimed otherwise, and the helpers that would
have fixed it were defined in a page it never loads. Container WebUI values now get a scheme
check before they reach window.open().

Plugin/unraid/pages/scheduler.php

@@ -1158,18 +1158,10 @@ if (vvOpenScriptId) {
   });
 }
 
-function vvEscHtml(s) {
-  return s.replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;');
-}
-
-// For text going INSIDE a double-quoted attribute, which vvEscHtml does not cover: it leaves "
-// alone, and a quote there ends the attribute early and silently destroys the handler after it.
-// That is not a theoretical hazard — it shipped, and an onclick built from JSON.stringify() output
-// was truncated to "vvErrOpenAtLine(" and did nothing at all when clicked.
-function vvEscAttr(s) {
-  return String(s).replace(/&/g,'&amp;').replace(/"/g,'&quot;')
-                  .replace(/</g,'&lt;').replace(/>/g,'&gt;');
-}
+// vvEscHtml() and vvEscAttr() moved to Varaverk.page, which every tab loads — they were needed on
+// pages that never include this one. The attribute variant exists because a " inside a
+// double-quoted attribute ends it early and silently destroys the handler after it: that shipped
+// once, truncating an onclick to "vvErrOpenAtLine(" so it did nothing at all when clicked.
 
 function vvPost(url, data) {
   const params = new URLSearchParams({csrf_token, ...data});