Snaglist 0.3.2

Added

• Tests. tools/test.sh runs Snaglist's security and privacy tests in a real browser, and
  tools/security-scan.sh runs the security scanners.

Changed

• Privacy statement. The review window now says what a report leaves out, and that the page title and text
  on screen are copied as they are, instead of saying no personal information is kept.

Security

The first full security check of Snaglist. Security has what was found, how each
problem was fixed and the test for it.

• Set-up tool. A shared link can no longer put a command, code or instructions into what the tool writes. The
  repository, the app details value and the language code are checked, with an error under the field.
• Choices in fields. Recorded steps and the trail no longer keep the option chosen in a list, a ticked box, a
  selected radio button or a picked suggestion: only that a choice was made, and where.
• Editable areas. Text typed into an editable area (contenteditable) is never in a report, and private parts
  inside the chosen part are left out of its text.
• Messages. Error and console messages keep each address without its query or hash, stay on one line, and
  show only the keys of a logged object.
• More keys and numbers replaced. access_token=, Authorization: Bearer, session=, pwd=, AWS key ids
  and phone numbers written with dots.
• The part's HTML. tel:, mailto: and similar links keep only their scheme, and value attributes such as
  aria-valuetext are taken out.
• GitHub. Text from the page can no longer mention anyone, break out of a code block or add a table column.
  Reports cut inside an emoji open on GitHub again.
• Safari. A very long console message no longer holds up the page while Snaglist cleans it.
• axe-core. Loaded only with its integrity hash; check.integrity gives the hash for your own copy.
• Removing Snaglist. destroy() puts back only its own wrappers, never another tool's, and takes away the
  axe-core it loaded.
• Example worker. Uses a rate limit when one is set up, refuses oversized requests before reading them, and
  stops mentions. Add a rate limit before you make it public.
• Privacy check. tools/check-private.sh catches a private word written with "TRex", and stops if it cannot
  find the repository.