fix: strip control characters from package.json version/name

prompt_package's own minimal JSON parser already rejects a name/
version value containing a literal newline or backslash, but a raw
control byte (e.g. an ESC-based terminal escape sequence) embedded
directly in the string passed through unfiltered and was written to
the prompt as-is.

Extends the existing check to also strip C0 control characters and
DEL from the extracted value before it's stored.

internal/p10k.zsh

@@ -2250,6 +2250,11 @@ prompt_package() {
               (( ! $+found[$field] ))   || return
               [[ -n $s ]]               || return
               [[ $s != *($'\n'|'\')* ]] || return
+              # Strip control characters (e.g. terminal escape sequences); a
+              # package.json field has no character restrictions, unlike a
+              # git ref name, so this can't be assumed safe to display as-is.
+              s=${s//[$'\x00'-$'\x1f'$'\x7f']/}
+              [[ -n $s ]]               || return
               found[$field]=$s
               (( $#found == 2 )) && break
             fi