Potential fix for code scanning alert no. 12: DOM text reinterpreted as HTML

[xbubbo]

Potential fix for https://github.com/UseInterstellar/Interstellar-Astro/security/code-scanning/12

To fully address this vulnerability, the user-supplied URL (flowing from search input and settings) must be validated and sanitized such that only safe schemes like https:// or http:// are allowed before being rendered as an iframe src. There are two robust ways to do this:

1. Sanitize at Input Time:
   Validate user input as soon as it's received and before storing it into storage.
2. Sanitize at Output Time:
   Before assigning to the iframe's src prop, ensure it's a valid HTTP(S) URL.

The best place is before passing to encodeProxyUrl in Browser.tsx (i.e., sanitize every tab.url before passing to that function), so that even data from bookmarks or other flows cannot inject a malicious URL into the iframe. This check will ensure only valid HTTP(S) URLs (or about:blank) are used.

Implementation steps:

• Add a sanitizeUrl function (in src/lib/tabs.ts), ensuring the input is "about:blank" or a safe HTTP(S) URL, or else default to "about:blank".
• Use this sanitizeUrl in Browser.tsx, wrapping the tab.url value on line 453 before passing it to encodeProxyUrl.
• Consider using the browser-provided URL constructor for parsing, or a regex matching HTTP(S) URLs.
• No new dependencies are strictly needed for this simple filter.

---

Suggested fixes powered by Copilot Autofix. Review carefully before merging.