fix(website): escape backslashes in file paths to prevent string context breakout

[Copilot]

Pull Request Checklist

• I have read and followed the CONTRIBUTING.md guidelines.
• My contribution adds a new instruction, prompt, agent, or skill file in the correct directory.
• The file follows the required naming convention.
• The content is clearly structured and follows the example format.
• I have tested my instructions, prompt, agent, or skill with GitHub Copilot.
• I have run npm start and verified that README.md is up to date.

---

Description

Addresses CodeQL alert #26: incomplete string escaping in getActionButtonsHtml(). File paths containing backslashes could break out of the JavaScript string literal in onclick attributes.

Before:

const escapedPath = filePath.replace(/'/g, "\\'");
// Input: "path\to\file's.txt" → "path\to\file\'s.txt" ❌ Backslash not escaped

After:

const escapedPath = filePath.replace(/\\/g, '\\\\').replace(/'/g, "\\'");
// Input: "path\to\file's.txt" → "path\\to\\file\'s.txt" ✅ Both escaped

Escaping order matters: backslashes first, then quotes.

---

Type of Contribution

• New instruction file.
• New prompt file.
• New agent file.
• New collection file.
• New skill file.
• Update to existing instruction, prompt, agent, collection or skill.
• Other (please specify):

---

Additional Notes

CodeQL validation confirms zero security alerts. Addresses review feedback from #637.

---

By submitting this pull request, I confirm that my contribution abides by the Code of Conduct and will be licensed under the MIT License.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[Copilot]

Pull request overview

This pull request addresses a security vulnerability (CodeQL alert #26) by fixing incomplete string escaping in the getActionButtonsHtml() function. File paths containing backslashes could previously break out of JavaScript string literals in onclick attributes, creating a potential code injection risk.

Changes:

• Added proper backslash escaping before single quote escaping in getActionButtonsHtml()
• Added explanatory comment documenting the escaping order and purpose

[mdabdullahalaminkhan]

👍