fix(security): top rungs of the xxzzzzy stack, rebased (#16826 #16827 #16828 #16829 #16833)

[Scottcjn]

Maintainer rebase of the five remaining rungs of @xxzzzzy's security stack, each carrying ONLY its own file(s) onto current main (the lower rungs are already merged). Authorship preserved per commit.

• fix(security): escape API-controlled values in elyanlabs-upstream-contributions innerHTML #16826 escape API-controlled values in the elyanlabs showcase
• fix(security): use HTTPS by default in beacon_client.py #16827 HTTPS by default in beacon_client.py
• fix(security): default JS SDK TLS verification to on #16828 JS SDK TLS verification on by default
• fix(security): escape API-controlled values in vscode-rustchain webview innerHTML #16829 escape values in the vscode-rustchain wallet panel
• fix(security): escape alertDiv + openTradeModal in otc-bridge templates #16833 escape alertDiv/openTradeModal in otc-bridge templates (+ test)

Supersedes those five PRs. Credit to @xxzzzzy.

🤖 Generated with Claude Code

https://claude.ai/code/session_014RDgENXHE8sjiekfdvw3jn