fix(www): strip article heading tags to a fixed point; drop hex-like issue ref from comment (#1281)

CodeQL js/incomplete-multi-character-sanitization re-fired on the
single-pass tag strip in prepareArticle (new alert on PR #1291); apply the
documented fixpoint idiom, matching the html-escape.ts sanitizeHeadExtras
structure. The www theme-token gate also read '(#1281)' on a line containing
'outline' as a hex color literal; reworded.

Author: DevBot

www/app/site-ui/article-body.ts

@@ -20,13 +20,17 @@ export function prepareArticle(html: string): { html: string; outline: ArticleOu
   const withIds = html.replace(
     /<h([23])([^>]*)>([\s\S]*?)<\/h\1>/gi,
     (_match, depth, attrs, body) => {
-      // Strip tags, then any angle bracket the tag pattern could not match
-      // (e.g. a `<script` fragment with no closing `>`), so the plain-text
-      // label can never carry a partial tag into the rail outline (#1281).
-      const label = String(body).replace(/<[^>]+>/g, '').replace(/[<>]/g, '').replace(
-        /&[^;]+;/g,
-        ' ',
-      ).trim();
+      // Strip tags to a fixed point, then any angle bracket the tag pattern
+      // could not match (e.g. a `<script` fragment with no closing `>`), so
+      // the plain-text label can never carry a partial tag into the rail
+      // outline (issue 1281).
+      let label = String(body);
+      for (;;) {
+        const stripped = label.replace(/<[^>]+>/g, '');
+        if (stripped === label) break;
+        label = stripped;
+      }
+      label = label.replace(/[<>]/g, '').replace(/&[^;]+;/g, ' ').trim();
       const stem = label.toLowerCase().normalize('NFKD').replace(/[^\p{L}\p{N}]+/gu, '-').replace(
         /(^-|-$)/g,
         '',