Scripting API: Properly escape values passed as arguments to pages. Disallow any parameter names which aren't valid as ECMA Script property names e.g. Anything beginning with a number, or containing non-word characters except $ or _
Add -Werror=format-security to the build args

Mageia, Fedora and other distros are requiring packages to be built with -Werror=format-security. We may as well add it to our args as a default so that we catch issues before they cause problems upstream. The good news is that the code contains no errors of this sort, but it doesn't hurt to guard against them being introduced in the future.