Security: Fix critical XSS and HTML injection vulnerabilities

[sam-ent]

Addresses critical security vulnerabilities by implementing Content Security Policy, disabling unsafe HTML rendering, and adding comprehensive sanitization.

Changes:

• Enable Content Security Policy with restrictive rules
• Disable unsafe HTML rendering in comrak options (unsafe_ = false)
• Add DOMPurify sanitization for all rendered HTML content
• Prevents script injection and other XSS attack vectors

Security Testing:

• npm run check (passed - 0 errors, 5 pre-existing warnings)
• npm run build (passed successfully)
• XSS payload testing pending: <img src=x onerror="alert(1)">
• Script injection testing pending: <script>console.log('xss')</script>
• CSP enforcement to be verified in DevTools Security tab

Files Modified:

• src-tauri/tauri.conf.json - Added CSP configuration
• src-tauri/src/lib.rs - Disabled unsafe HTML rendering
• package.json - Added DOMPurify dependencies
• src/lib/MarkdownViewer.svelte - Added DOMPurify sanitization

Dependencies added:

• dompurify ^3.3.1
• @types/dompurify ^3.0.5

This PR addresses security vulnerabilities identified in code audit and hardens the application against common web attacks.