Prevent PlaceholderAPI output from being evaluated as AdvancedCore JavaScript in reward commands

[BenCodez]

Motivation

• Reward console-command processing expanded internal placeholders and PlaceholderAPI output before scanning for AdvancedCore [Javascript=...] expressions, which allowed attacker-influenced placeholder output to become executable script when the JavaScript engine was enabled.

Description

• Add replaceJavascriptOnly helpers for Player and OfflinePlayer in PlaceholderUtils that evaluate configured [Javascript=...] expressions without invoking PlaceholderAPI expansion.
• Update MiscUtils.executeConsoleCommands(...) paths to call the new replaceJavascriptOnly first, then substitute internal reward placeholders with replacePlaceHolder(...), and finally apply PlaceholderUtils.replacePlaceHolders(...) (PlaceholderAPI), ensuring placeholder output is not reinterpreted as script.
• Add a focused unit test PlaceholderUtilsTest that asserts replaceJavascriptOnly does not invoke PlaceholderAPI.
• AI disclosure: This pull request was created with assistance from OpenAI Codex and reviewed by BenCodez.

Testing

• Ran repository checks git diff --check and staged/commit validations which passed.
• Added AdvancedCore/src/test/java/com/bencodez/advancedcore/tests/messages/PlaceholderUtilsTest.java to assert that PlaceholderUtils.replaceJavascriptOnly(...) does not call PlaceholderAPI.
• Attempted to run mvn -Dtest=PlaceholderUtilsTest test but the build could not complete because Maven failed to resolve maven-resources-plugin:3.3.1 from Maven Central (HTTP 403), so the unit test could not be executed in this environment.

---

Codex Task