🚀 reddont 0.1.13

Security fixes, found by new security scans, and a smaller, hardened image.

🔄 Changed

No framing by other sites. Every response sends X-Frame-Options: DENY, so other sites, dashboards such as Homarr or Organizr included, can no longer show reddont in a frame. It also sends X-Content-Type-Options: nosniff and Referrer-Policy: same-origin, so links to Reddit and other sites no longer tell them which page they came from, and no longer sends X-Powered-By. #83
A smaller image. The image installs only runtime packages, takes Debian's security updates when it is built, and drops privileges with util-linux's setpriv instead of gosu, with the same user, groups and home directory. Publishing now scans each platform's image with Grype and stops on a high or critical vulnerability that has a fix. #83

Open redirect after signing in. A ?redirect= path with dot segments, such as /a/..//evil.com, became //evil.com after it was checked, so a login link could send someone to another site once they signed in, with a password or through OIDC. Redirect targets are now checked as a browser reads them. #83
API source whitelist. An API_WHITELIST range with a malformed prefix length, such as 10.0.0.0/ with the length left out, let every address of its family reach the API. A malformed range now lets none through. #83
Post links. A post whose link isn't an http or https URL, such as javascript:, no longer gets a clickable link. #83
OIDC. Stored refresh tokens decrypt only with GCM's full 16-byte tag, and claim paths such as OIDC_ADMIN_CLAIM read only the claims' own properties. #83
Pasted credentials. A bearer token of nothing but quotes cleared the saved Reddit credential, and an Authorization: line with another scheme, such as Basic, was saved as an empty one. Both are now refused with a message. #83

Security scans. Pull requests and main now run CodeQL, which fails while any alert is open, Semgrep, a dependency audit (bun audit and GitHub's dependency review), Gitleaks, zizmor on the workflows, fuzz tests of the code that handles untrusted input, and ZAP's baseline scan of the built image. The published images are scanned three times a week, and every GitHub Action is pinned to a commit. #83
Coverage. JavaScript line coverage is 98.10%, with all 385 tests passing and none skipped. #84

Update the image to ghcr.io/voc0der/reddont:0.1.13, or follow :latest. No configuration or database changes are needed; PUID and PGID work as before.
If a dashboard shows reddont in a frame, that stops working: reddont now refuses to be framed by other sites.
If API_WHITELIST has a range without its prefix length, such as 10.0.0.0/, it now lets nothing through. Write the length out, as in 10.0.0.0/8.

Full Changelog: v0.1.12...v0.1.13

_{Release contributors: @voc0der}