feat(security): add domain allowlist to sanitizeUrl and sanitizeHtml

[Ajibose]

Closes #728

Summary

• Adds ALLOWED_LINK_DOMAINS config array to src/constants/app.constants.ts with safe default domains (teachlink.com, youtube.com, youtube-nocookie.com, vimeo.com, github.com, loom.com)
• Extends sanitizeUrl() to validate the URL hostname against the allowlist in addition to the existing protocol check — disallowed domains return null
• Registers a DOMPurify afterSanitizeAttributes hook that strips href attributes pointing to non-allowlisted absolute URLs; relative URLs (same-origin) are preserved
• data: and javascript: URIs are blocked at the protocol level in both sanitizeUrl() and the DOMPurify hook

Test plan

• Allowed domains pass through sanitizeUrl() (teachlink.com, youtube.com, youtube-nocookie.com, subdomains)
• Disallowed domains return null from sanitizeUrl() (evil.com, lookalike domains)
• javascript:, data:, vbscript:, ftp: URIs are blocked
• Empty strings, whitespace, relative URLs, malformed URLs return null
• sanitizeHtml() keeps hrefs for allowed domains
• sanitizeHtml() strips hrefs for disallowed domains while preserving link text
• sanitizeHtml() keeps relative hrefs (/about, #section)
• 34 tests — npx vitest run src/utils/__tests__/sanitize.test.ts

[drips-wave]

@Ajibose Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits