CSV-injection sanitizer misses carriage-return (\r) prefix

Describe the bug

gradio.utils.sanitize_value_for_csv guards against CSV/formula injection by prefixing values that start with a dangerous character. The OWASP reference the function cites lists the risky leading characters as =, +, -, @, Tab (0x09) and Carriage Return (0x0D). The current unsafe_prefixes list includes Tab (\t) but not Carriage Return (\r):

unsafe_prefixes = ["=", "+", "-", "@", "\t", "\n"]

So a value beginning with \r followed by a formula slips through unsanitized, even though a value beginning with \t is caught.

Reproduction

from gradio.utils import sanitize_value_for_csv

sanitize_value_for_csv("\t=1+2")   # "'\t=1+2"   (sanitized)
sanitize_value_for_csv("\r=1+2")   # "\r=1+2"    (NOT sanitized)  <-- bug

When flagged/exported data containing such a value is written to CSV and opened in a spreadsheet, the \r-prefixed formula can be interpreted, which is the class of attack sanitize_value_for_csv exists to prevent.

Proposed fix

Add \r to unsafe_prefixes (and ",\r" to unsafe_sequences) so Tab and Carriage Return are handled symmetrically, matching the OWASP reference. Happy to send a small PR with tests.