hardening: use parameterized LIKE clauses for filter inputs

[somethingwithproof]

Description

Four files build LIKE clauses by direct string interpolation after passing filter through sanitize_search_string. That function does not strip %, _, or \, so a user can craft wildcard patterns for timing-based inference or excessive result set expansion.

Affected Files

• mactrack_view_devices.php lines 159-162
• mactrack_view_sites.php lines 96-100
• mactrack_macauth.php lines 222-223
• mactrack_sites.php lines 294-298

Suggested Fix

Use db_qstr('%' . get_request_var('filter') . '%') matching the pattern already used correctly in mactrack_view_macs.php, mactrack_view_arp.php, and mactrack_view_dot1x.php.