XSS fix(webui): sanitize chat markdown rendering

[BestDevOfc]

Summary

• XSS vulnerability that can modify the DOM, seems to have been reported but never fixed in Security Bug Report: XSS in Agent0ai Dashboard/UI (Unescaped User Content) #943
• the fix sanitizes rendered chat markdown with the existing DOMPurify pipeline
• I made sure to preserve the existing path links, KaTeX rendering, and chat image attachments

Root cause

Chat messages render Markdown with marked.parse(...) and then inject the resulting HTML into the DOM. This change applies the existing sanitizeHtml(...) helper to rendered chat Markdown before path-link decoration and innerHTML assignment.

The sanitizer keeps the default behavior unchanged for existing safe-markdown users. The chat renderer opts into the existing chat-specific rendering needs:

• preserves the custom <latex> tag when KaTeX rendering is enabled
• allows base64 bitmap image data URLs for Agent Zero chat image attachments
• continues stripping event handlers, javascript: URLs, scripts, SVG, and other unsafe content

[frdel]

Thank you!

[BestDevOfc]

Thank you for the quick actions, after the patch can a CVE be issued so older versions are tracked and indexed?