fix: remediate DOM-based XSS in PushTX

- Refactor renderMessage to return HTMLElement and accept Node content
- Add textMessage helper for plain-text messages
- Replace innerHTML assignments with replaceChildren + DOM APIs
- Stop reflecting raw network parameter in parseFragment error
- Convert provider-error HTML construction to ProviderErrorsError class
- Escape API-returned values in renderTxDetails via textContent
- Add restrictive CSP meta tag to index.html
- Rebuild website and single-file artifacts
- Regenerate SHA256SUMS

cc-implementation/index.html

@@ -4,6 +4,10 @@
 <head>
   <meta charset="UTF-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <meta
+    http-equiv="Content-Security-Policy"
+    content="default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; connect-src https://mempool.space https://blockstream.info; img-src 'none'; font-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none';"
+  />
   <title>COLDCARD NFC Push TX</title>
 </head>