fix: resolve 12 security findings from audit (SSRF, XSS, CSP, SRI)

[adurrr]

Summary

Comprehensive security hardening based on a full codebase audit. Resolves 12 findings across 4 severity levels.

Client-side SSRF prevention (High)

• IvooxAdapter: validate URL scheme (HTTPS only) and domain (*.ivoox.com only) before fetching third-party HTML
• AzuraCastAdapter: validate API URL scheme (HTTPS only) before fetching
• detectSourceType: tighten regexes to match actual domain patterns (e.g., evil.com/ivoox.com/ no longer matches)

XSS hardening (High/Medium)

• URL scheme validation in button, figure, hero, schedule shortcodes — reject javascript:, data:, vbscript: in href attributes
• Audio/video URL validation in podcast-player and video shortcodes
• Program-card icon validation — ensures icon front matter contains actual SVG markup, not arbitrary HTML
• Document unsafe=true security implications in exampleSite/hugo.toml

Template injection hardening (Low)

• Replace endsWith URL matching with proper urlsMatch() function comparing pathname+search by URL object
• Add sessionStorage state validation — reject restored state with non-HTTP schemes

Content Security Policy (Medium)

• Add CSP <meta> tag with nonce-based script-src
• Nonce applied to all inline scripts (theme toggle, i18n injection, language redirect, dropdown handlers)

Subresource Integrity (Low)

• Add fingerprint + integrity to code-copy.js, podcast-player.js, podcast-player.css

RSS/XML injection (Medium)

• Replace Go-style %q quoting with transform.XMLEscape in atom:link elements
• Add XMLEscape to all RSS attribute values (itunes:image, itunes:category, itunes:author, itunes:name, itunes:email, itunes:subtitle, enclosure)

Misc

• Use localStorage for language redirect flag (instead of sessionStorage) to prevent repeated redirects in incognito sessions

Verification

• Build: 116 EN / 86 ES pages
• Tests: 91 JS + 39 Hugo pass
• 13 files changed, +124/-36 lines