Function substitute_cookies 

pub fn substitute_cookies(template: &str, cookies: &CookieMap) -> String

Replaces %KEY% placeholders in a template with values from the cookie map.

Security

Uses single-pass scanning to prevent cascade expansion (second-order injection).