security(ui): escape and validate miniMarkdown link destinations #368

Problem

On dborup/CoreScope master 1f423e0627976c961fb7a40f45016e817e582cc3, public/roles.js builds Markdown links in miniMarkdown() with href="$2". The rest of the text is HTML-escaped first, but the captured destination is inserted into an HTML attribute without attribute escaping or scheme validation. public/home.js renders the result in Home checklist/step HTML. A crafted destination in imported or otherwise untrusted Home customization content could break out of href or use an unsafe URL scheme.

Reference for the narrow fix: nashmesh/CoreScope PR 16 (reference only). Related but distinct: #333 covers other HTML sinks fed by node, observer and route data.

Requested change

• Escape the Markdown link destination for HTML attribute context before constructing the anchor.
• Reject unsafe schemes after normalizing case and embedded ASCII controls/whitespace. Keep ordinary HTTPS, relative and fragment links working.
• Render a rejected link as escaped label text. Preserve existing Markdown behavior outside link destinations.
• Add focused tests for quote breakout, scheme obfuscation and safe links, and register them in the active test entry points.

Acceptance

• Hostile link destinations cannot create attributes or executable links in the actual Home rendering path.
• Safe links and ordinary checklist text still render and navigate as before.
• Frontend unit tests, relevant browser regression and XSS preflight pass on the proposed change.

This is a source-code finding, not a claim of an observed production exploit. No live-site change is authorized by this issue.