Security improvements and API compatibility fixes (v0.3.6)

- Add recursive key sorting for response signing compatibility
- Fix IP header spoofing in rate limiting with trusted proxy support
- Add CSRF protection to CSV export with nonce verification
- Explicit Twig autoescape for XSS prevention
- Escape status values in CSS classes
- Update README with security documentation and trusted proxy config
- Update translations for v0.3.6

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

src/Plugin.php

@@ -98,6 +98,7 @@ final class Plugin
         $this->twig = new Environment($loader, [
             'cache' => WP_CONTENT_DIR . '/cache/wc-licensed-product/twig',
             'auto_reload' => true, // Always check for template changes
+            'autoescape' => 'html', // Explicitly enable HTML autoescape for XSS protection
         ]);
 
         // Add WordPress functions as Twig functions