Fix code-scanning security alerts

[jrepp]

Summary

• restrict the CI workflow token to read-only repository contents
• replace batch-demo HTML string rendering with safe DOM construction
• render user-controlled addresses, zone IDs, formatted output, and diagnostics with textContent
• harden the equivalent single-address diagnostic path

Root cause

The CI workflow inherited the repository's default GITHUB_TOKEN permissions instead of declaring least privilege. The browser demo also concatenated textarea input and parser-derived values into an HTML string before assigning it to innerHTML, allowing DOM text to be reinterpreted as markup.

Impact

This addresses the five missing-workflow-permissions findings and the high-severity js/xss-through-dom finding currently reported by CodeQL. The demo preserves its existing result layout and expandable diagnostics while treating all dynamic values as text.

Validation

• actionlint .github/workflows/ci.yml
• inline demo script syntax check with Node.js
• npm run lint
• dependency security regression tests
• Node.js, WASM, synchronous API, error, and diagnostic test suites
• build-output validation

Validated with the pinned Node.js 26.7.0 and npm 12.0.2 toolchain.