fix(mgt-components): sanitize search result summaries with DOMPurify to prevent XSS (#3493)

* fix(mgt-components): sanitize search result summaries with DOMPurify to prevent XSS

sanitizeSummary() previously only replaced proprietary Graph API tags
(<ddd/>, <c0>, </c0>) without sanitizing other HTML. This allowed stored
XSS via attacker-controlled content indexed by Microsoft Search and
rendered through .innerHTML in mgt-search-results.

Add DOMPurify to sanitize HTML after proprietary tag conversion, allowing
only safe formatting tags (b, em, strong, span) with no attributes.

fix(test): set experimentalDecorators in web-test-runner tsconfig

The @web/dev-server-esbuild plugin passes the tsconfig to esbuild as
tsconfigRaw, which does not resolve `extends`. After bumping esbuild,
its default switched to standard (TC39) decorators, causing Lit's
@Property to throw "Unsupported decorator location: field/getter" and
breaking test module imports. Declare experimentalDecorators and
emitDecoratorMetadata directly so esbuild emits legacy decorators.


Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: gavinbarron

.vscode/settings.json

@@ -5,8 +5,9 @@
   "editor.codeActionsOnSave": {
     "source.fixAll.eslint": "explicit"
   },
-  "lit-html.tags": ["mgtHtml"],
-  "typescript.tsdk": "node_modules/typescript/lib",
+  "lit-html.tags": [
+    "mgtHtml"
+  ],
   "css.validate": false,
   "less.validate": false,
   "scss.validate": false,
@@ -17,9 +18,23 @@
     "editor.defaultFormatter": "stylelint.vscode-stylelint"
   },
   "stylelint.packageManager": "yarn",
-  "stylelint.snippet": ["css", "less", "postcss", "scss"],
-  "stylelint.validate": ["css", "less", "postcss", "scss"],
-  "cSpell.words": ["mailenabledsecurity", "noreferrer"],
+  "stylelint.snippet": [
+    "css",
+    "less",
+    "postcss",
+    "scss"
+  ],
+  "stylelint.validate": [
+    "css",
+    "less",
+    "postcss",
+    "scss"
+  ],
+  "cSpell.words": [
+    "mailenabledsecurity",
+    "noreferrer"
+  ],
   "liveServer.settings.root": "storybook-static",
-  "liveServer.settings.port": 6006
-}
+  "liveServer.settings.port": 6006,
+  "js/ts.tsdk.path": "node_modules/typescript/lib"
+}