readQueryVariable('token', ...) preferred the unsigned host-uuid token
from the URL, which novncd rejects; use the signed token the view
renders, like the full page does.
- Validate and coerce console query parameters (view_only, scale, resize_session, clip_viewport) to strict booleans via to_bool in console/views.py
- Sanitize view parameter to strictly 'lite' or 'full'
- Apply escapejs filter to all JS string interpolations in console-vnc-full.html, console-vnc-lite.html, console-spice-lite.html, and console-xterm.html
- Replace unsafe '| safe' filter in console-spice-lite.html with escapejs
- Add unit tests for XSS query param mitigation and escapejs character encoding
- Upgrade vendored noVNC library in static/js/novnc/ from 1.2.0 to 1.7.0
- Remove obsolete IE11 polyfills (promise.js, browser-es-module-loader)
- Preserve custom app/styles/lite.css for embedded lite view
- Update console-vnc-full.html stylesheets, modern icon set, and dialogs
- Modernize console-vnc-full.html startup via UI.start() with Django context mapping
- Dynamically resolve package.json and localization dictionaries via import.meta.url
