bug(security): parameter descriptions & notes rendered unescaped in Component Browser webview

[eFAILution]

Follow-up hardening surfaced during the #234 review, tracked separately from #237 (which covered the component description sinks, now fixed).

Several free-form, source-controlled fields are still interpolated raw into the Component Browser webview HTML (the webview runs with enableScripts: true and no CSP <meta>):

• Parameter descriptions — server render around componentBrowserProvider.ts:1819, and the client-side innerHTML path around :2058–:2071
• Parameter default values — around :1822 / :2061
• Component notes — around :1984

(Line numbers are indicative and will drift.) These originate from a component's spec YAML (spec.inputs.*.description / .default, and template notes), which for a third-party component source is attacker-controllable. A value containing markup — e.g. <img src=x onerror=...> — would render/execute in the webview.

Pre-existing on main and independent of #234/#237 — filing so it isn't lost.

Fix: route these through escapeHtml / renderInlineMarkdown on the server side, and textContent (or the escaped renderer) on the client innerHTML paths — consistent with the description sinks fixed in #237/#234, and the <script>-context data now handled by serializeForScript.

Note: component names are GitLab-constrained (lowercase alphanumeric + hyphens), so the many ${component.name} interpolations are not a practical vector; the free-form fields above are.