fix(security): sandbox webview JS and validate openExternal URL (F-01, F-02)

[xxzzzzy]

Fix: sandbox webview JS and validate openExternal URL

What this PR fixes

Three confirmed findings from the bug-hunter scan of
vscode-extension (F-01, F-02, F-03).

F-01 — Medium: XSS via unescaped single-quote in webview onclick

escapeHtml escaped & < > " but not '. The buildHtml wrapped
escapeHtml(issue.html_url) in a single-quoted JS string inside an
onclick HTML attribute. A ' in the URL closes the JS string,
allowing arbitrary script injection in the webview context.

F-02 — Medium: vscode.env.openExternal accepts any URI scheme

The openIssue handler did not validate the URL scheme. Combined
with F-01, an attacker controlling a GitHub issue page (DNS/API
compromise) could redirect via the legit html_url to vscode://
or javascript: schemes.

F-03 — Low: claimBounty does not enforce numeric issueNumber

The TS type was issueNumber?: number, but postMessage is JSON.
A string passed the truthiness check and got interpolated into the
PR compare URL via template literal.

Changes

• escapeHtml now also escapes ' (F-01, defence-in-depth).
• New escapeJsString(s) = JSON.stringify(s) helper used at the
  view-issue onclick so the URL goes through full JSON escaping
  before being interpolated (F-01, load-bearing fix).
• openIssue handler now only follows https: URLs and silently
  drops malformed values (F-02).
• claimBounty requires Number.isInteger(message.issueNumber)
  (F-03).
• A strict Content-Security-Policy meta tag is added to the
  webview HTML (default-src '\''none'\'', script-src '\''unsafe-inline'\'',
  style-src '\''unsafe-inline'\''). The webview host does not
  expose a CSP by default, so this prevents any future XSS from
  reaching the network.

Risk

Low. Existing well-formed GitHub URLs render unchanged. Malformed
inputs are now rejected silently rather than passed through.

Suggested bounty tag

security, xss, vscode-extension

[Scottcjn]

The fix itself is correct and security-critical (accepted on the merits — webview XSS + openExternal scheme allowlist). One blocker before merge: the new line print(f" Generation: {"Claude" if used_claude else "template stub"}") nests same-type double-quotes inside an f-string — that's a SyntaxError on Python < 3.12, and our CI + nodes run 3.11. Swap the inner quotes to single ({'Claude' if used_claude else 'template stub'}) and rebase onto main (#16788 just merged, so this stack needs a rebase). Then it's a clean merge. Great catch on the underlying vuln.

[Scottcjn]

The https-only openExternal, Number.isInteger, and CSP additions are all real and welcome. One blocker: escapeJsString (which is JSON.stringify) is injected unescaped into a double-quoted onclick="openIssue(${issue.number}, ${escapeJsString(issue.html_url)})" — the JSON's own double-quotes break the attribute, which breaks the button for benign URLs and re-opens attribute injection. Build the onclick without inlining a quoted string into a quoted attribute (e.g. a data-attribute + addEventListener, or HTML-escape after JSON-encoding). Also heads-up: this branch is stacked on #16788 and #16789, so it'll need a rebase once those land.

[xxzzzzy]

@Scottcjn Updated 45b8602 to address the only blocker, and rebased the branch onto current origin/main so it now touches a single file (vscode-extension/src/bountyBrowser.ts).

F-01 fix — escapeJsString injected into a quoted attribute (root cause):
The view-issue button no longer inlines JSON.stringify(issue.html_url) into a double-quoted onclick="..." attribute. Instead the URL is placed in a data-issue-url="..." attribute (which escapeHtml HTML-encodes), and the click is handled by a single delegated document.addEventListener('click', …) that reads data-issue-number + data-issue-url and calls openIssue(...) via acquireVsCodeApi().postMessage(...). The host-side onDidReceiveMessage still validates https: and Number.isInteger(issueNumber).

The escapeJsString helper has been deleted from the module (no longer reachable from the template), so the bypass class is gone — the host extension is the single source of truth for which URLs and issue numbers are forwarded.

Rebase: branch was carrying the testautomaton + miner + tipbot + comment-mod + telegram + otc-bridge + bounty-2864 + bounties.json changes from the stacked-on-#16788 layout; those are now all restored to origin/main so this PR is reviewable in isolation.

No other behaviour changed: the https:-only check on openExternal, Number.isInteger check on the claim payload, and the defence-in-depth Content-Security-Policy meta tag are still in place.