CSV formula injection sanitizing skips the header row #54

#52 added _sanitize_csv_cell to neutralize CWE-1236 in export_csv, but it only runs on values. writer.writeheader() writes fields unchanged, and those field names come from keys in the scraped payload.

from brightdata.datasets.utils import export_csv

export_csv([{'=HYPERLINK("http://evil","x")': "safe", "ok": "=1+1"}], "out.csv")

out.csv:

"=HYPERLINK(""http://evil"",""x"")",ok
safe,'=1+1

The value gets the leading quote, the header does not, so opening the file in Excel or Sheets still evaluates the header cell.

Running the header through the same sanitizer closes it. Note the explicit fields= argument should probably be sanitized too, since it can carry the same names. Happy to send a PR.