fix: pin highlight.js script and theme with SRI (#145)

* fix: pin highlight.js script and theme with SRI

* fix: don't crash workspace when highlight.js fails to load

* address Will's feedback

Author: clean6378-max-it

templates/base.html

@@ -16,8 +16,12 @@
   </script>
   <link rel="stylesheet" href="/static/css/style.css">
   <!-- Highlight.js for code syntax highlighting -->
-  <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.9.0/styles/vs2015.min.css" id="hljs-theme">
-  <script src="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.9.0/highlight.min.js"></script>
+  <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.9.0/styles/vs2015.min.css" id="hljs-theme"
+    integrity="sha512-mtXspRdOWHCYp+f4c7CkWGYPPRAhq9X+xCvJMUBVAb6pqA4U8pxhT3RWT3LP3bKbiolYL2CkL1bSKZZO4eeTew=="
+    crossorigin="anonymous">
+  <script src="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.9.0/highlight.min.js"
+    integrity="sha512-D9gUyxqja7hBtkWpPWGt9wfbfaMGVt9gnyCvYa+jojwwPHLCzUm5i8rpk7vD7wNee9bA35eYIjobYPaQuKS1MQ=="
+    crossorigin="anonymous"></script>
   <!-- Marked.js for Markdown rendering -->
   <script src="https://cdnjs.cloudflare.com/ajax/libs/marked/12.0.1/marked.min.js"
     integrity="sha384-3zf4Pen4fXU90jGg3cxmo7BF4dq8HMtF2s07c/Hhd1Fh+Encm6ApPvNm8vrMJbWu"

templates/workspace.html

@@ -296,9 +296,11 @@ <h2>${escapeHtml(tab.title)}</h2>
 
   main.innerHTML = html;
 
-  main.querySelectorAll('pre code').forEach(block => {
-    hljs.highlightElement(block);
-  });
+  if (typeof hljs !== 'undefined') {
+    main.querySelectorAll('pre code').forEach(block => {
+      hljs.highlightElement(block);
+    });
+  }
 }
 
 function renderToolCall(tc) {