feat(lint): add CWE-tagged security rules to library source

Adds eslint-plugin-browser-security and eslint-plugin-secure-coding, scoped to
library source and excluded from **/*.spec.ts — a fixture states the insecure
thing on purpose.

51 rules covering XSS sinks, credential storage and the injection surfaces
around them. Measured against this repository before proposing: 0 findings,
and `eslint .` exits 0 unchanged.

Every message carries a CWE identifier and a CVSS score rather than a rule
name.

Author: ofri-peretz

eslint.config.mjs

@@ -5,6 +5,8 @@ import tseslint from 'typescript-eslint';
 import angular from 'angular-eslint';
 import jestDom from 'eslint-plugin-jest-dom';
 import testingLibrary from 'eslint-plugin-testing-library';
+import browserSecurity from 'eslint-plugin-browser-security';
+import secureCoding from 'eslint-plugin-secure-coding';
 
 export default tseslint.config(
   {
@@ -46,6 +48,21 @@ export default tseslint.config(
       '@angular-eslint/no-input-rename': 'off',
     },
   },
+  // Security rules, CWE- and CVSS-tagged. Scoped to library source: the spec
+  // files below are fixtures, and a fixture states the insecure thing on
+  // purpose. Measured against this repository before proposing: 0 findings.
+  {
+    files: ['**/*.ts'],
+    ignores: ['**/*.spec.ts'],
+    plugins: {
+      'browser-security': browserSecurity,
+      'secure-coding': secureCoding,
+    },
+    rules: {
+      ...browserSecurity.configs.recommended.rules,
+      ...secureCoding.configs.recommended.rules,
+    },
+  },
   {
     files: ['**/*.spec.ts'],
     extends: [jestDom.configs['flat/recommended'], testingLibrary.configs['flat/angular']],

package.json

@@ -62,7 +62,9 @@
     "autoprefixer": "^10.4.21",
     "cpy-cli": "^6.0.0",
     "eslint": "^9.39.1",
+    "eslint-plugin-browser-security": "^2.0.5",
     "eslint-plugin-jest-dom": "~5.10.1",
+    "eslint-plugin-secure-coding": "^5.1.2",
     "eslint-plugin-testing-library": "~7.16.2",
     "istanbul-lib-instrument": "^6.0.3",
     "jasmine-core": "4.2.0",