fix(security): address VS Code extension vulnerabilities — prototype pollution, token exposure, ReDoS, missing CSP

fix(security): address VS Code extension vulnerabilities — prototype pollution, token exposure, ReDoS, missing CSP #368