fix: pin highlight.js script and theme with SRI

[clean6378-max-it]

Closes #140

highlight.js was the only cdn tag in base.html without sri. this pins the 11.9.0 script and vs2015 theme with the official cdnjs hashes and crossorigin="anonymous", same as marked and dompurify. no version bump.

checked a fenced code block still highlights and devtools shows no sri errors. pytest tests/test_xss_sanitization.py passes.

Summary by CodeRabbit

• Security
  • Added integrity verification and anonymous cross-origin settings to Highlight.js assets loaded from the CDN.
• Bug Fixes
  • Prevented syntax highlighting errors by only applying highlighting to code blocks when Highlight.js is available after content loads.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 204887a9-8ac6-4342-900f-2f6c02f3c3fe

📥 Commits

Reviewing files that changed from the base of the PR and between 81a19ab and ed8b280.

📒 Files selected for processing (1)

• templates/base.html

🚧 Files skipped from review as they are similar to previous changes (1)

• templates/base.html

---

📝 Walkthrough

Walkthrough

Highlight.js CDN assets now include SRI metadata and anonymous cross-origin loading. Chat rendering only invokes syntax highlighting when Highlight.js is available.

Changes

Highlight.js integration safeguards

Layer / File(s)	Summary
Pin Highlight.js CDN assets templates/base.html	The Highlight.js CSS and JavaScript tags retain their existing URLs and add SRI and anonymous cross-origin attributes.
Guard syntax highlighting templates/workspace.html	renderChat checks that hljs is defined before highlighting rendered code blocks.

Estimated code review effort: 1 (Trivial) | ~2 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and accurately summarizes the main change: pinning highlight.js assets with SRI.
Linked Issues check	✅ Passed	The changes match issue #140 by adding SRI and crossorigin to highlight.js assets without version changes.
Out of Scope Changes check	✅ Passed	The workspace.html guard is a small supporting change for the same highlighting flow, not unrelated scope.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/highlightjs-sri-pin

---

_{Comment @coderabbitai help to get the list of available commands.}