Security audit remediation: sanitize assets and add validation CI

[arumes31]

Summary

• pin CodeQL and add a dedicated theme validation workflow
• block cross-origin SVG inlining and sanitize same-origin SVG content before DOM insertion
• remove the mutable Google Fonts import for self-contained rendering
• fix repository-relative installation links and document support/security
• add CODEOWNERS, security policy, and an MIT license

Verification

• node --check master-theme/custom.js
• actionlint
• self-contained asset policy check
• git diff --check

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: e66d3bf4-596f-4d7f-9c0e-52e45bdfd8af

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}