Fix unsafe HTML export by escaping project metadata

[Chaitu7032]

fixes - #5308

PR Description

What was happening before

When a project was exported as an HTML file, several project fields (project name, description, image URL, project ID, and project data) were directly inserted into the HTML template without escaping.

Because these values can be user-provided or come from imported/shared projects, this meant that HTML or script content could unintentionally be interpreted by the browser when the exported .html file was opened. This could also break the page layout or allow unintended script execution.

What this PR changes

Context-safe HTML escaping

{{ project_name }} and {{ project_description }} are now always HTML-escaped.

{{ data }} is always rendered as text only, never as executable HTML.

Hardened attribute handling

projectid is now encodeURIComponent-encoded before being inserted into the button URL.

project_image is sanitized to allow only:

http:// and https://

relative URLs

data:image/*;base64
Unsafe schemes such as javascript: and data:text/html are rejected.

Safer template replacement

Switched to function-based template replacements to avoid $1, $&, and related replacement-string edge cases.

Why this is useful

Music Blocks projects are frequently shared and exported as HTML files. Ensuring that exported files render project information as text (and not executable HTML) helps prevent unexpected behavior and makes sharing projects safer and more predictable for all users.

Scope

-->Minimal, self-contained change
-->No new dependencies
-->No change to user workflow or project format
--> Focused only on HTML export safety

[github-actions]

✅ All Jest tests passed! This PR is ready to merge.

[github-actions]

✅ All Jest tests passed! This PR is ready to merge.

[Chaitu7032]

@walterbender sir ,
This PR addresses a critical issue in the HTML export flow where user-controlled project fields were previously inserted into the export template without context-safe handling. please review it . if any issues , please mention me ..

[github-actions]

✅ All Jest tests passed! This PR is ready to merge.

[Chaitu7032]

@walterbender sir , I understand you’re busy, and I’d appreciate it if you could review this when you have time. thankyou for continuous support