Sanitize scripts and dangerous content in EPUB/MOBI reader

[acx10]

Strips out scripts, event handler attributes, javascript: URLs, and dangerous data: URIs from EPUB and MOBI content before rendering. Also adds a CSP header on the backend response and injects a CSP meta tag into each document as defense-in-depth. SVG images are now excluded from the image allowlist since they can contain embedded scripts.

[github-actions]

Frontend Test Results

413 tests  ±0   413 ✅ ±0   1s ⏱️ ±0s
  7 suites ±0     0 💤 ±0 
  1 files   ±0     0 ❌ ±0 

Results for commit a8fdf34. ± Comparison against base commit a97ada5.

♻️ This comment has been updated with latest results.

[github-actions]

Backend Test Results

  336 files  ±0    336 suites  ±0   1m 28s ⏱️ -1s
2 492 tests ±0  2 477 ✅ ±0  15 💤 ±0  0 ❌ ±0 
2 549 runs  ±0  2 534 ✅ ±0  15 💤 ±0  0 ❌ ±0 

Results for commit a8fdf34. ± Comparison against base commit a97ada5.

This pull request removes 3 and adds 3 tests. Note that renamed tests count towards both.

org.booklore.service.metadata.MetadataRefreshServiceTest ‑ [2] fieldOptions = org.booklore.model.dto.request.MetadataRefreshOptions$FieldOptions@2268f9f1, enabledFields = null
org.booklore.service.metadata.MetadataRefreshServiceTest ‑ [3] fieldOptions = null, enabledFields = org.booklore.model.dto.request.MetadataRefreshOptions$EnabledFields@848a41f
org.booklore.service.metadata.MetadataRefreshServiceTest ‑ [4] fieldOptions = org.booklore.model.dto.request.MetadataRefreshOptions$FieldOptions@4374beee, enabledFields = org.booklore.model.dto.request.MetadataRefreshOptions$EnabledFields@783234a3

org.booklore.service.metadata.MetadataRefreshServiceTest ‑ [2] fieldOptions = org.booklore.model.dto.request.MetadataRefreshOptions$FieldOptions@25d0ae3d, enabledFields = null
org.booklore.service.metadata.MetadataRefreshServiceTest ‑ [3] fieldOptions = null, enabledFields = org.booklore.model.dto.request.MetadataRefreshOptions$EnabledFields@4de02359
org.booklore.service.metadata.MetadataRefreshServiceTest ‑ [4] fieldOptions = org.booklore.model.dto.request.MetadataRefreshOptions$FieldOptions@75ca4566, enabledFields = org.booklore.model.dto.request.MetadataRefreshOptions$EnabledFields@5f3c76a8

♻️ This comment has been updated with latest results.