security: remediate CodeQL code-scanning alerts (#2171)

* security: remediate CodeQL code-scanning alerts (picker XSS sinks, test sanitization, vendored DataTables exclusion)

Remediates all 11 open CodeQL alerts on the default branch:

- version-picker.js (js/xss-through-dom, alerts 1-3): percent-encode every
  DOM-derived path component (select.value, parsed location segments) at URL
  construction time via encodePath()/langUrlFor(), and tighten the
  parseLocation slug charset to [A-Za-z0-9._-]. No-op on legitimate sphinx
  slugs — URLs stay byte-identical (asserted by tests).

- workers/apex/test/manifest.test.ts (js/incomplete-multi-character-
  sanitization, alert 6): strip HTML comments from the root.html fixture
  repeatedly to a fixpoint instead of a single pass.

- docs/_static/js/datatables.js (alerts 4,5,7-11): excluded from CodeQL
  analysis via .github/codeql/codeql-config.yml (new codeql-cfg-path input
  to the fleet reusable workflow). The file is vendored stock DataTables
  1.11.5; the flagged helpers are display/sort normalization, not
  sanitization boundaries. Excluding keeps the vendored copy byte-identical
  to upstream instead of hand-patching it.

Adds 9 picker tests (hostile-input encoding + slug-charset accept/reject);
workers suite 103/103 green.

🤖 Generated by [robots](https://vyos.io)

* security: normalize pre-existing percent escapes in encodePath

Adversarial-review finding (Codex, medium): location.pathname returns
well-formed escapes verbatim, so blind encodeURIComponent double-encoded
them (%2E -> %252E), broke the HEAD probe on escaped deep links, and
dumped the user at the version root. Each segment is now decoded first
(malformed escapes keep the raw segment — no throw), then re-encoded to
canonical single encoding. Decoding cannot resurrect dot-segments:
the URL parser resolves '.'/'..' and their percent-encoded forms during
navigation, so pathname never presents them (verified against the WHATWG
parser in Node).

workers suite 106/106 (+2 regression tests, mutation-verified).

🤖 Generated by [robots](https://vyos.io)

* security: normalize percent escapes per run, not per segment

Round-2 adversarial finding (Codex, medium): whole-segment decode meant
one malformed escape (a%20b%zz) threw for the segment and double-encoded
the valid escapes beside it. encodeSegment now decodes+re-encodes each
well-formed %HH run independently; literal spans (including a bare '%')
always pass through encodeURIComponent, so taint neutralization holds
unconditionally; a run decoding to invalid UTF-8 stays verbatim (already
pure %HH text).

workers suite 108/108 (+2 discriminating regression tests).

🤖 Generated by [robots](https://vyos.io)

1 files changed, 11 insertions, 0 deletions

diff --git a/.github/codeql/codeql-config.yml b/.github/codeql/codeql-config.yml
new file mode 100644
index 00000000..60563975
--- /dev/null
+++ b/.github/codeql/codeql-config.yml
@@ -0,0 +1,11 @@
+# CodeQL configuration for vyos-documentation.
+#
+# docs/_static/js/datatables.js is vendored stock DataTables 1.11.5 — unmodified
+# third-party code (MIT). CodeQL flags its internal HTML-strip/sort helpers
+# (js/incomplete-multi-character-sanitization, js/incomplete-sanitization), which
+# are display/sort normalization routines, not sanitization boundaries. The file is
+# excluded from analysis rather than hand-patched, so the vendored copy stays
+# byte-identical to upstream and remains trivially re-vendorable on the next bump.
+
+paths-ignore:
+  - docs/_static/js/datatables.js