fix(security): prevent XSS in Mermaid WebView

[ex3ndr-bot]

Summary

Fixes XSS vulnerability in the Mermaid diagram WebView renderer.

Problem

User/AI-supplied mermaid diagram content was interpolated directly into an HTML template without sanitisation:

<div id="mermaid-container" class="mermaid">
    ${props.content}
</div>

A payload like </div><img src=x onerror=alert(1)> could break out of the mermaid container and execute arbitrary JavaScript in the WebView context.

Solution

Instead of HTML interpolation, the content is now:

1. Passed via JSON.stringify() which safely escapes all special characters
2. Parsed in JavaScript and rendered using mermaid.render() explicitly
3. Error messages are also escaped to prevent XSS via error output

This approach:

• Prevents HTML injection attacks
• Maintains full mermaid diagram functionality
• Handles errors gracefully with escaped output

Testing

Tested with:

• Normal mermaid diagrams (flowcharts, sequence diagrams)
• XSS payloads like </div><script>alert(1)</script>
• Diagrams containing special characters (<, >, ", ')

Closes #668