fix(config): prevent YAML structure injection via env var substitution (#5091)

* fix YAML structure injection in declarative file config env var substitution

Environment variable values containing newlines were substituted verbatim
into YAML text before parsing, allowing a value like
"legit-service\nmalicious_key: injected" to create extra YAML keys.

The spec explicitly requires: "It MUST NOT be possible to inject YAML
structures by environment variables." Fix wraps values containing \n or \r
in YAML double-quoted scalars. Simple values are returned as-is so that
YAML type coercion still applies per "Node types MUST be interpreted after
environment variable substitution takes place."

Assisted-by: Claude Sonnet 4.6

* update CHANGELOG with PR number #5091

Assisted-by: Claude Sonnet 4.6

* fix ruff: move yaml import to top level

Assisted-by: Claude Sonnet 4.6

---------

Co-authored-by: Riccardo Magliocchetti <riccardo.magliocchetti@gmail.com>