doomsider shadow denial of service

An attacker who can send chat messages or otherwise inject commands into the game's command-processing pipeline can craft input containing special shell characters. When the vulnerable `eval` statement processes this input in `chat_commands` or `core_logloop`, those characters can cause the script to crash or behave unexpectedly, resulting in a denial of service. The attack requires local access and is considered difficult to exploit [patch_id=2247376].

The vulnerability resides in `modules/chatfunctions.dtsd` (the `chat_commands` function) and `core/core_loops.dtsd` (the `core_logloop` function). Both locations previously used `eval` to execute commands constructed from user-supplied input without sanitization [patch_id=2247376].

The patch removes all `eval` invocations in both `chat_commands` and `core_logloop`, replacing them with direct function calls (`$USERCOMMAND ...` and `$RECIEVEDCOMMAND ...`). It also adds a `lib_arraycontains` check to validate that the requested chat command exists in the allowed list before executing it. These changes prevent arbitrary shell interpretation of user-supplied strings, closing the denial-of-service vector [patch_id=2247376].