fix(security): resolve all remaining CodeQL HTML sanitization alerts (Groups C & D)

[phine-apps]

Summary

This PR resolves all remaining 22 CodeQL security alerts (js/incomplete-multi-character-sanitization) across the codebase by introducing iterative loop-based HTML tag removal.

1. Dedicated stripHtmlTags helper (src/markdown/domUtils.ts)

• Implemented stripHtmlTags(input: string): string using an iterative do ... while loop (as officially recommended by CodeQL / CWE-116 guidelines) to safely remove all nested/sequential HTML tags without causing multi-character bypasses.

2. Group C: Internal text comparison logic (17 alerts)

• Table alignments (src/markdown/tableDiff.ts): Used stripHtmlTags in alignColumns and alignRows for column/row text similarity extraction.
• Header fuzzy matching (src/markdownDiff.ts): Used stripHtmlTags in section header text extraction.
• Structural diff transforms (src/markdown/structuralDiff.ts): Used stripHtmlTags in getHeaderText, stripFootnote, unescapeHtml, boldToHeadingRe/headingToBoldRe text comparison, stripInsignificant, checkIfAllContentIsWrapped, and cleanInnerDiffTags.

3. Group D: Test suites & visual utilities (5 alerts)

• Updated src/test/unit/alert.test.ts, src/test/visual/vrtUtils.ts, and src/test/unit/markdownDiff.test.ts to use stripHtmlTags and robust loop-based script removal.

---

Verification

• Unit Tests: 233 passing (3s) (pnpm test:unit)
• VS Code Integration Tests: 50 passing (2s) (npm run test)
• Compile & Lint: 0 errors