fix(@schematics/angular): escape module specifier in insertImport

insertImport builds an `import ... from '<fileName>'` statement by
interpolating fileName directly between single quotes with no escaping.
A fileName containing a single quote breaks out of the string literal,
so any caller that passes untrusted data as the module specifier (e.g.
a schematic using addRootProvider's external() with a value sourced
from user/project config) ends up inserting attacker-controlled source
into the target file rather than a plain import path.

fileName is now escaped for backslashes and single quotes before being
interpolated, matching the existing single-quote output format so the
common case (a real module specifier) is byte-for-byte unchanged.

Author: herdiyana256

packages/schematics/angular/utility/ast-utils.ts

@@ -77,9 +77,10 @@ export function insertImport(
   // if there are no imports or 'use strict' statement, insert import at beginning of file
   const insertAtBeginning = allImports.length === 0 && useStrict.length === 0;
   const separator = insertAtBeginning ? '' : `;${eol}`;
+  const escapedFileName = fileName.replace(/\\/g, '\\\\').replace(/'/g, "\\'");
   const toInsert =
     `${separator}import ${open}${importExpression}${close}` +
-    ` from '${fileName}'${insertAtBeginning ? `;${eol}` : ''}`;
+    ` from '${escapedFileName}'${insertAtBeginning ? `;${eol}` : ''}`;
 
   return insertAfterLastOccurrence(
     allImports,