Potential fix for code scanning alert no. 22: Client-side cross-site scripting

[rajbos]

Potential fix for https://github.com/rajbos/github-copilot-token-usage/security/code-scanning/22

In general, to fix DOM-based XSS when using innerHTML, ensure that any untrusted data interpolated into HTML is first passed through contextual escaping or, better, avoid building HTML as strings and instead use DOM APIs (createElement, textContent, appendChild) so the browser treats untrusted data as text, not markup.

For this specific case, we should keep the existing behavior (a single call to renderSessionTable that returns an HTML string) but ensure that any interpolated values that may be strings are properly escaped. The file already uses an escapeHtml helper when rendering error messages, so the best fix is:

1. Make the escapeHtml helper available to renderSessionTable (if it is not already in scope where we need it).
2. Inside renderSessionTable, apply escapeHtml to any string fields coming from SessionFileDetails (e.g., sf.editorSource, any file path/name, or other textual attributes) before including them in template literals that contribute to the final HTML string.
3. Where we expect numeric data (counts, totals) we can either leave them as-is or coerce to numbers (Number(...)) before interpolation to avoid accidental string injection.

Since we are restricted to edits in this file and must not alter behavior more than necessary, we will:

• Add a small, local helper function safeText(value: unknown): string above renderSessionTable, which uses the existing escapeHtml (assumed defined elsewhere in the same file) if the value is a string, or stringifies non-strings safely.
• Update the usage of sf.editorSource when constructing keys or labels that end up rendered into HTML to use safeText.
• Ensure any other likely string insertions in the visible part of renderSessionTable that use fields from detailedFiles go through safeText before being concatenated.

This way, renderSessionTable can continue returning an HTML string, but any data derived from tainted message content is escaped before reaching innerHTML, eliminating the XSS vector without changing the visible functionality.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.