fix(docs): prevent DOM XSS in LinkedIn graph demo

[Beverly621]

Summary

Fixes #2251.

The LinkedIn Data Discovery graph view now renders crawled and uploaded fields with DOM APIs instead of interpolating them into innerHTML. Chat markdown is sanitized with DOMPurify, streamed text is appended as text nodes, and URL-bearing fields are limited to HTTP(S) before assignment.

The OpenAI key storage behavior is intentionally unchanged because it is outside this issue.

Maintainer feedback coverage

Requirement	Implementation
Use DOM APIs for sinks 1–3 and 5	Replaced dynamic innerHTML rendering with createElement, textContent, and replaceChildren
Sanitize the Markdown path in sink 4	Uses DOMPurify.sanitize(marked.parse(text))
Do not append streamed output as raw HTML	Streaming chunks are appended as text nodes with explicit <br> elements
Validate profile_url before assignment	Passed through safeHttpUrl() and limited to HTTP(S)
Validate avatar_url before assignment	Passed through safeHttpUrl() with a trusted fallback avatar URL
Avoid regex-based HTML escaping	No escapeHtml() or equivalent regex escaping is used
Keep API-key storage changes separate	localStorage and API-key handling are intentionally unchanged
Target the integration branch	This PR targets develop
Add regression coverage	Added 9 focused tests covering the five sinks, URL schemes, and text-node rendering

p.id, which is also assigned to a profile link in sink 3, is passed through the same safeHttpUrl() validation. This remains within the reported issue scope.

List of files changed and why

• docs/apps/linkdin/templates/graph_view_template.html — remove the five reported DOM XSS paths while preserving the existing UI and behavior.
• tests/test_issue_2251_linkdin_xss.py — cover DOM rendering, markdown sanitization, streaming text, and URL-scheme validation.

How Has This Been Tested?

• pytest -q tests/test_issue_2251_linkdin_xss.py (9 passed)
• ruff format --check tests/test_issue_2251_linkdin_xss.py
• ruff check tests/test_issue_2251_linkdin_xss.py
• Extracted inline JavaScript checked with node --check
• git diff --check

Checklist:

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have added/updated unit tests that prove my fix is effective or that my feature works
• Full project test suite run locally (the focused regression suite passes)