Restrict component links to http and https URLs

[kah-ja]

What

A component link is written into the status page anchor as it was stored (resources/views/components/component.blade.php:11), and the API accepts any string for it ('link' => ['string'], src/Data/Requests/Component/CreateComponentRequestData.php:30 and the update equivalent). A value such as javascript:alert(1) therefore ends up in href, where Blade escaping does not help, because the value is a syntactically valid attribute; only the scheme is the problem.

Why

The Filament form already restricts the field with ->url() (src/Filament/Resources/Components/ComponentResource.php:60), so the same expectation is missing on the API and MCP paths that share the request data. Those paths are authorised by the components.manage token ability, so any holder of a component-managing token can store the value, and every visitor of the status page then receives the anchor.

How

• link is validated as url:http,https on create and update, which matches what the form has always allowed and is stricter than a bare url rule (Laravel's default protocol list covers about 250 schemes).
• Component::formattedLink() returns the link only when it is an http or https URL, and the status page anchor uses that accessor. Values stored before this change stay in the database and render as plain component names instead of links, which is the same shape as formattedDescription() for the Markdown fix in 23adbb88.
• Left unchanged on purpose: the API resource keeps exposing the raw link attribute, since an API consumer is not an HTML context, and the column is not rewritten by a migration.

Behaviour change

A component whose link is not an http or https URL loses its anchor on the status page, and updating such a component through the API now fails validation until the link is corrected or cleared.

Testing

PHP 8.3.30 in a container, dependencies from composer update, assets from npm ci and npm run build, workbench prepared with composer build.

• composer test:unit: 954 passed, 2 todos, 0 failed.
• composer test:lint (Pint): PASS.
• vendor/bin/phpstan analyse: no errors.
• New tests: tests/Feature/Api/ComponentTest.php covers the rejected javascript: link and an accepted https link; tests/Feature/StatusPage/StatusPageTest.php covers a stored javascript: link rendering without an anchor and an https link still rendering one. The two negative cases fail on main at 78b41c4, the two positive ones pass on both sides.

References

GHSA-8jf8-9272-94v7 (reported privately, in triage)