Sanitize plugin transform HTML by default and document trusted opt-out

[Copilot]

Plugin transform() results were written directly to innerHTML, creating an XSS path when plugin output included untrusted HTML. This change makes plugin HTML sanitization the default behavior and documents the explicit opt-out for trusted renderers.

• API

  • Adds sanitize?: boolean to EzyTablesOptions
  • Defaults sanitize to true
  • Preserves existing raw HTML behavior behind sanitize: false for trusted plugin output

• Plugin HTML handling

  • Sanitizes plugin transform() output before assigning it to innerHTML
  • Removes dangerous container tags such as script, iframe, object, embed, link, meta, style, and base
  • Strips inline event/style attributes and unsafe URL-bearing attributes
  • Uses a safe URL allowlist for sanitized plugin markup

• Documentation

  • Calls out that plugin transforms render as HTML, not text
  • Documents the new sanitize option and when to disable it
  • Updates README and site docs/examples to reflect the safer default

• Coverage

  • Adds focused tests for default sanitization and the trusted sanitize: false path

const table = new EzyTables({
  target: "#myTable",
  data: myData,
  plugins: [badgePlugin],
  sanitize: true, // default
});

// Opt out only for fully trusted HTML
const trustedTable = new EzyTables({
  target: "#myTable",
  data: myData,
  plugins: [trustedHtmlPlugin],
  sanitize: false,
});