fix(security): detect remote SVG subresources loaded via src, link href and bare-string @import

[hivecommons-hive]

Security Fix

findRemoteReferences() in scripts/lib/svg-active-content.mjs is the control
that stops an imported SVG from making a visitor's browser fetch a subresource
from a third-party host, and scripts/validate-architecture-assets.mjs:188-190
records each of its findings as a blocking CI error.

It only inspected an href attribute on a RESOURCE_ELEMENTS element and a
url(...) token in CSS. Three shapes that load a remote subresource carry
neither and walked past it silently:

1. src was never inspected at all. It is not an SVG attribute, so it
   reaches the scanner through the HTML a foreignObject is allowed to carry
   (foreignObject is deliberately permitted, and the swisscom diagram in the
   corpus already contains one).
2. link was absent from RESOURCE_ELEMENTS, so a stylesheet href on a
   link element was never tested.
3. A CSS @import with a bare-string target (@import "https://...";) is
   valid CSS and fetches the stylesheet exactly as the url(...) form does,
   but carries no url( token for CSS_URL_PATTERN to match.

When a visitor opens such an SVG directly at the site origin - the threat model
this module is written against - each one discloses their IP address,
User-Agent and Referer to a host the diagram's author chose. Both writers of
these files take third-party input: the daily import-architectures job and
import-architecture-issue.mjs.

What changed

scripts/lib/svg-active-content.mjs only:

• inspect src on every element. Unlike href there is no element on which
  src reads as visitor-chosen navigation, so it needs no allow-list.
• add link to RESOURCE_ELEMENTS. a deliberately stays out: a hyperlink is
  navigation the visitor chooses, and the existing draw.io corpus carries one.
• add CSS_IMPORT_PATTERN and scan style blocks for it alongside
  CSS_URL_PATTERN. A target matched by both is still reported once.

Verification

• New tests in tests/svg-remote-subresources.test.mjs (a new file, so it
  cannot conflict with test: cover reachable fallback branches in svg-active-content.mjs #818 - see below). Mutation-checked both directions:
  5 of the 9 fail without the source change, and all 9 pass with it.
• test:unit:coverage:check exit 0; scripts/lib/svg-active-content.mjs at
  100.00% lines.
• validate:architecture-assets exit 0 over all 50 corpus SVGs (unchanged -
  the corpus contains no src, link href or @import, so this adds no new
  failures).
• prettier --check . exit 0; build:production exit 0.

Relationship to open PRs

Disjoint from #818 ("test: cover reachable fallback branches in
svg-active-content.mjs"), which appends to tests/svg-active-content.test.mjs
and does not modify scripts/lib/svg-active-content.mjs. This PR modifies only
that source file and adds a separate test file, so the two can merge in either
order.

Closes #835

---

Filed by sec-check agent (ACMM L4/L5 - hold-gated mode). Hold-gated: human review required.

— hive: agent=sec-check backend=copilot model=claude-opus-5 copilot=1.0.88

[hivecommons-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "sec-check" agent while Hive policy required a human checkpoint for that agent. Non-outreach agents are held at ACMM L3–L5; the outreach agent is always held because it publishes project-facing communication.

Hive will automatically remove the hold label once current policy no longer requires a level hold for "sec-check". If this is an outreach PR, a human must review it and remove the label.