fix(export): harden HTML export against XSS via adversarial identifiers

[gianlucaciocci]

Summary

• Escape <, >, & (and U+2028/U+2029) to \uXXXX in the JSON payload before embedding in HTML — these never legally appear outside string contents in serde_json output, so the escaped output is still valid JSON that round-trips through JSON.parse.
• Move the payload into a <script type="application/json" id="grafly-data">…</script> data tag, parsed via JSON.parse(document.getElementById('grafly-data').textContent). Defense in depth: the data tag never executes as JS, and the escape would neutralise a </script> breakout even if it did.
• Applied to all three HTML emitters: artifact, module, and package views.
• Updated SECURITY.md: removed the Known-limitation entry; added a Threat-surface row describing the mitigation.

Closes #42

Test plan

• cargo test -p grafly-export — 4 new unit tests cover: </script> breakout neutralisation, ampersand escape, serde JSON round-trip, and end-to-end rendered HTML containing no raw < in the data payload.
• cargo test --workspace — full suite green.
• cargo build --release — clean.
• grafly analyze . smoke test — generated grafly_artifacts.html, grafly_modules.html, grafly_packages.html all contain the new grafly-data data tag.