Potential fix for code scanning alert no. 10: DOM text reinterpreted as HTML

[0xcucumbersalad]

Potential fix for https://github.com/decocms/studio/security/code-scanning/10

The best fix is to validate and sanitize image URLs at the point they enter state (input change) and at render time before assigning to img.src, using a strict allowlist of protocols (http:/https:) plus optional relative URLs. This preserves existing functionality (users can still paste normal image URLs and upload images) while preventing unsafe schemes from ever being rendered.

Concretely:

• File: apps/web/src/views/registry/image-upload.tsx
• Add a small helper function in this file to normalize/validate URL values.
• Use it in the URL input onChange handler so onChange receives only safe values (or empty string if unsafe).
• Use the same helper when rendering <img src=...> as defense in depth.

No new package is required; use built-in URL.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

---

Summary by cubic

Sanitizes image URLs in the registry image upload to address code scanning alert #10 (DOM text reinterpreted as HTML). Previously raw input was assigned to img.src; now only http/https (including relative) are accepted and normalized to absolute, otherwise cleared, preventing unsafe schemes from rendering and affecting how values display/store.

• Adds sanitizeImageUrl in apps/web/src/views/registry/image-upload.tsx; used in URL input onChange and when rendering <img src>.
• Allows only http:/https:; trims input; invalid or disallowed schemes return an empty string. Relative inputs render as absolute. data:, file:, and javascript: are rejected; update any callers that relied on those schemes.
• Wraps the onChange handler for formatting only; no behavior change.

^{Written for commit e429ddd. Summary will update on new commits.}