fix: render a hostile token symbol as text, and put a floor under the CSP (closes #307)

A token's symbol is whatever its symbol() returns, the block explorer passes it
through unfiltered, and balanceLine() interpolated it into an innerHTML string.
A token with the 1,000 holders the spam filter asks for, airdropped to the
victim, could therefore paint a full-viewport cross-origin iframe over the
wallet's own UI, on the screens where the user is used to typing their password.

escapeHtml moves to the new src/shared/html.js as a pure string replace over &,
<, >, " and '. The implementation it replaces round-tripped through a detached
element's textContent, which escapes neither quote character, and it was already
in use inside data-copy="..." and would have been inside href="...". Being pure
also makes it testable without a DOM shim.

Every interpolation into an innerHTML string across src/popup/views/ was audited
rather than only the reported one. Also unescaped: the transaction lists'
direction label (the explorer's method name, attacker-chosen for an attacker's
contract), the wallet name and ENS name in the Home wallet list, the URL in the
explorer link's href, the blockie data: URI, and the confirmation screen's
warning line, which carries only fixed strings today but is one wiring change
from carrying scraped explorer text. Explorer URLs are now built by one helper
that percent-encodes the path segment, so a from/to out of explorer JSON cannot
re-point the link. Where a value is a markup fragment this code just built, or a
loop index, or a locally computed number, it stays bare; the rule and the reason
are stated at the top of helpers.js.

Both manifests now declare default-src 'self' with frame-src 'none'. Four
directives had to stay looser than 'self' and none of them generalises:
style-src needs 'unsafe-inline' because the popup sets presentation through
style="..." attributes and Firefox has never implemented style-src-attr; img-src
needs data: for the blockies; connect-src needs https: and http: because the RPC
endpoint is user-configurable and a local node over http://127.0.0.1 is a
supported configuration. frame-src, form-action and base-uri are named rather
than inherited, because the last two do not fall back to default-src at all.
tests/manifest.test.js now pins the whole directive set exactly, in both
directions, and README.md carries the reasoning.

Displayed symbols are capped at 12 characters, the bound lookupTokenInfo()
already applied to a symbol read straight off a contract; the explorer path had
none. The cap is a layout bound and is documented as not being the security
control. isSpoofedSymbol() is untouched: it answers whether a symbol collides
with a known ticker, which is a different question, and repurposing it here
would have been the wrong control.

Verified failing first, four ways. Restricting escapeHtml to & < > (the escape
the old textContent round trip actually performed) fails 5 unit tests including
the data-copy attribute break-out. Removing the length cap fails 3. Dropping
default-src from manifest/chrome.json fails 2. Removing both the escape and the
cap and running the full Chrome suite fails the new browser test with the
attack reproduced: an <iframe id="pwn"> in the popup DOM, intercepting pointer
events over the Back button.

tests/balanceLineEscaping.test.js

@@ -0,0 +1,69 @@
+// balanceLine() is the row that issue #307 was reported against: every
+// screen that lists a holding renders through it, and the symbol it renders
+// is whatever an ERC-20's symbol() returned. This asserts against the
+// string it emits, which is what gets assigned to innerHTML.
+//
+// The browser half of the same claim — that a real Chrome renders that
+// string as text and puts no iframe in the popup DOM — is in
+// tests/e2e/run.js. This half runs inside the 20-second make test cap.
+
+"use strict";
+
+// helpers.js reaches for both at module scope through the modules it pulls
+// in. Neither is exercised by anything asserted here.
+global.chrome = {
+    storage: {
+        local: {
+            get: () => Promise.resolve({}),
+            set: () => Promise.resolve(),
+        },
+    },
+    runtime: { sendMessage: () => {} },
+};
+global.document = {
+    getElementById: () => null,
+    createElement: () => ({ style: {}, classList: { toggle() {} } }),
+    body: { prepend: () => {} },
+    addEventListener: () => {},
+};
+
+const { balanceLine } = require("../src/popup/views/helpers");
+const { MAX_SYMBOL_LENGTH } = require("../src/shared/symbolDisplay");
+
+// The payload from the issue's reproduction, verbatim.
+const HOSTILE_SYMBOL =
+    '<iframe id="pwn" src="https://dapp.e2e.test/" ' +
+    'style="position:fixed;left:0;top:0;width:360px;height:600px;z-index:99999"></iframe>';
+
+describe("balanceLine", () => {
+    test("emits a hostile symbol as text, not as an element", () => {
+        // Deliberately asserted on the escaping alone. The cap truncates
+        // this payload before its id attribute, so an assertion about the
+        // rest of the payload would pass on the cap and say nothing about
+        // the escape.
+        const html = balanceLine(HOSTILE_SYMBOL, 1, null, null);
+        expect(html).not.toContain("<iframe");
+        expect(html).toContain("&lt;iframe");
+    });
+
+    test("caps the symbol before rendering it", () => {
+        const html = balanceLine("A".repeat(4096), 1, null, null);
+        expect(html).toContain("A".repeat(MAX_SYMBOL_LENGTH - 1) + "…");
+        expect(html).not.toContain("A".repeat(MAX_SYMBOL_LENGTH + 1));
+    });
+
+    // The token id lands inside data-token="...", so a quote in it is a
+    // way out of the attribute and into a new one.
+    test("keeps a quote-bearing token id inside its attribute", () => {
+        const html = balanceLine("TKN", 1, null, '" onclick="alert(1)');
+        expect(html).not.toContain('onclick="');
+        expect(html).toContain('data-token="&quot; onclick=&quot;alert(1)"');
+    });
+
+    test("renders an ordinary holding unchanged", () => {
+        const html = balanceLine("USDC", 1.5, null, "0xabc");
+        expect(html).toContain("<span>USDC</span>");
+        expect(html).toContain("<span>1.5000</span>");
+        expect(html).toContain('data-token="0xabc"');
+    });
+});