refactor(webview): webviewHtml.ts imports vscode at module scope, so the shared helper can't be unit-tested

[eFAILution]

Follow-up from #275.

Problem

src/webview/webviewHtml.ts:1 imports vscode at module scope. Its two siblings, src/webview/inlineMarkdown.ts and src/webview/scriptData.ts, both carry a "vscode-free and pure so the unit suite can drive it directly" header and both have unit tests. This module breaks that, and it is the one every future webview document will depend on.

Adding tests/unit/webviewHtml.test.ts today would pull import * as vscode from 'vscode' into the mocha runner, which cannot resolve it outside the extension host. That aborts the entire run, not just the one file — the same failure mode src/parsers/specParser.ts already works around by importing from errors/types rather than the errors barrel.

So the shared helper the other five webview documents are meant to build on is currently the only one of the three that cannot be tested.

Suggested fix

createNonce needs no vscode at all, and cspMetaTag only reads webview.cspSource. Taking that as a string:

export function cspMetaTag(cspSource: string, nonce: string): string

leaves assetUri as the only function that needs vscode, and makes the other two unit-testable. The single call site in componentBrowserProvider.ts passes webview.cspSource instead of webview.

Then add tests/unit/webviewHtml.test.ts covering the nonce length and alphabet, and the directive set the meta tag emits — including that style-src carries no 'unsafe-inline'. That property is the whole point of #275 and nothing currently guards it against being reintroduced.

[eFAILution]

Closed by #305, merged to beta as b236672. Reaches main with the next release.