fix: escape dynamic radar data in browser UI

[DorianChn]

Summary

• escape GitHub-sourced star names, descriptions, tags, scores, and search highlights before inserting them into HTML
• allow only http/https external links and add rel="noopener noreferrer" to new-tab links
• encode project card JSON with encodeURIComponent instead of embedding raw JSON in an HTML attribute
• validate the embedded browser JavaScript in CI

Validation

• embedded JavaScript parsed with Node vm.Script
• scripts/update_stars.py passed py_compile
• manifest.json parsed successfully
• git diff --check