fix(web): replace regex HTML sanitization with sanitize-html

[williamzujkowski]

Summary

Closes the remaining 15 CodeQL findings in apps/web/src/lib/github.ts:

• 12 × js/incomplete-multi-character-sanitization
• 2 × js/bad-tag-filter
• 1 × js/double-escaping

All flagged the fundamental fact that regex-based HTML stripping is bypass-able. sanitize-html (v2.17) uses a real HTML parser (htmlparser2) so malformed/nested tags and encoded entities cannot escape the allowlist.

Two configs preserve existing contracts

• sanitizeContent → allowedTags: [] (plain text). Used by DiffViewer.svelte for content fetched from the us-code repo via GitHub API.
• sanitizeExcerpt → allowedTags: ['mark'] (Pagefind highlight wrapper). Rendered via {@html ...} in SearchBar.svelte.

Test change worth flagging

One test changed expectation: the prior regex would decode <script>... then strip — sanitize-html preserves entities as entities, which is the actually-safe behavior (entity-encoded text renders as literal text, never as parsed HTML). Test updated to assert no raw </> in the output rather than the specific decoded form — captures the security property without coupling to the legacy regex's "decode then strip" pattern.

Test plan

• pnpm install resolves cleanly (added: sanitize-html 2.17.3 + @types/sanitize-html 2.16.1)
• pnpm build (Astro SSG + Pagefind index) passes — sanitize-html survives the SSR/bundle path
• pnpm test (269 tests) green
• pnpm typecheck clean
• pnpm lint clean
• CI build passes
• Post-merge CodeQL re-scan: 15 alerts in github.ts should clear

🤖 Generated with Claude Code