Index module: smaller hardening items from the LLMAI-202 audit

Low-severity items found while auditing the LLMAI-202 fix, grouped:

• clearIndexCore is farm-wide. CurrentUserCollectionManager.clearIndexCore requires admin right on the current wiki only and then deletes every chunk of every wiki. A subwiki admin can wipe the whole farm's index. Expected: restrict the delete to the current wiki, or require main-wiki admin.
• search_collections emits <documentId> and <reference> unsanitized (MCPSearchCollectionsTool), while <url> and <language> go through sanitizeElementText. Page names may contain <, > and line breaks, so a page name can forge provenance elements in the result. Expected: sanitize both, consistent with the 2026-07-19 decision on <url>.
• A builder throwing a RuntimeException aborts the search for every collection. DefaultCollectionManager.getAuthorizationManagerMap catches IndexException only. It fails closed, but one misbehaving third-party rights method takes all collections down. Expected: exclude only that collection, as for IndexException.
• Indexing a subwiki page for a main-wiki collection never sets the context wiki (DocumentIndexer.indexDocument saves and restores the wiki id without setting it), so the collection is looked up in the subwiki. Functional bug, no leak found.
• Pages whose name ends in a backslash are silently never indexed: their id does not round-trip through the withparameters resolver.
• Logging: DefaultCollectionManager logs a full exception at WARN (about line 343) and an ERROR without its exception (about line 366).
• Migrator concatenates the old collection id into HQL. Admin-only input; use a bind.