Address Snyk findings raised in discussion #7413:
- error-handler: inject error title, additionalLog, stackTrace, and
meta into the global error alert via textContent/setAttribute instead
of innerHTML interpolation. Also fixes a latent <h2> close-tag typo.
- break-reminder-overlay: use textContent (not innerHTML) for the
reminder message; switch to decodeURIComponent to match a producer-
side encodeURIComponent change (also fixes a latent parse bug for
messages containing & or =).
- local-rest-api: reject any request that arrives with a web Origin
header. Closes the simple-POST CSRF gap (text/plain bodies are not
preflighted by CORS) on top of the existing Host allowlist.
The Snyk findings on Google OAuth CLIENT_SECRET (Desktop client per
RFC 8252) and proxy-agent rejectUnauthorized (opt-in for self-hosted
WebDAV with self-signed certs) are documented false positives and
intentional, respectively; both already carry explanatory comments.
