fix: resolve all 6 CodeQL security and quality alerts

[TommiLindfors]

Resolves all 6 open CodeQL code scanning alerts.

Changes

evaluator.ts — Prototype pollution (alerts 5 & 6)

• Use \Object.create(null)\ instead of {}\ in \�uildFactData\ to prevent prototype pollution when fact_type paths contain _proto_, \constructor, or \prototype\

check-anchors.ts — Bad tag filter + double escaping (alerts 1 & 4)

• Allow whitespace before >\ in </script>\ / </style>\ closing tags (regex: </script\s*>)
• Decode &amp;\ last in the entity decoding chain to prevent double-unescaping (&amp;lt;\ → &lt;\ → <)

validate.ts — Incomplete sanitization + double escaping (alerts 2 & 3)

• Loop HTML comment stripping (<!-- -->) until stable, preventing crafted nested markers from surviving a single pass
• Decode &amp;\ last (same fix as check-anchors)

Testing

All 142 tests pass. The one flaky test (\EPERM\ on
mSync\ in \�fterEach) is a pre-existing Dropbox file-locking issue unrelated to these changes.