fix(frontend): validate structured citation URL schemes

[sanjayy0612]

Fixes #254

Problem

Structured tool citations were assigned directly to anchor href attributes without validating their URL schemes. This allowed clickable javascript:, data:, file:, and other unsafe destinations.

Root cause

The structured-citation rendering path did not share the HTTP(S)-only policy already applied to Markdown links.

Solution

Add a small URL normalizer that uses the browser URL parser and accepts only absolute http: and https: URLs. Apply it before rendering structured citations.

Regression tests cover JavaScript, data, file, blob, protocol-relative, malformed, empty, and valid HTTP(S) values.

Testing

• pytest tests/test_widget_markdown.py: 17 passed
• pytest: 177 passed, 6 skipped
• ruff check frontend tests
• ruff format --check tests
• git diff --check

[google-oss-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign chasecadet for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.