Fix XSS vulnerability and improve error handling in manifest-import component

[Copilot]

Addresses critical security vulnerability and code quality issues in the manifest-import component identified in static review.

Changes

• Security: Escape error.message and error.manifestUrl before rendering to prevent XSS attacks from malicious query parameters or API responses
• Error handling: Wrap JSON parsing in try/catch to handle non-JSON error responses (HTML error pages, gateway errors)
• Code cleanup: Remove unused getUserFromToken import
• Lifecycle: Add disconnectedCallback() for proper component cleanup

Example

Before:

${failed.map(error => `
    <div class="error-item">
        <strong>${error.message}</strong>
        <div class="error-url">${error.manifestUrl}</div>
    </div>
`).join('')}

After:

${failed.map(error => `
    <div class="error-item">
        <strong>${escapeHtml(error.message || '')}</strong>
        <div class="error-url">${escapeHtml(error.manifestUrl || '')}</div>
    </div>
`).join('')}

CodeQL: 0 alerts

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.