fix: resolve the open CodeQL alerts (#156)

Strip HTML tags and XML comments until the text no longer changes, so that
nested input cannot reassemble a tag or comment after a single pass
(js/incomplete-multi-character-sanitization in website/.eleventy.js and
website/scripts/validate-version-info.js).

Limit the GITHUB_TOKEN of the PR compile check and the test version-XML
workflow to read access (actions/missing-workflow-permissions).

Claude-Session: https://claude.ai/code/session_01FJBfPYm6rCH4zD6T7bcC7Y

website/scripts/validate-version-info.js

@@ -28,14 +28,29 @@ function extractTag(xml, tagName) {
     return match ? match[1].trim() : null;
 }
 
+// Applies the removal until nothing changes, so that nested input such as
+// "<!-<!---->-->" cannot leave a fresh comment behind after a single pass.
+function removeUntilStable(value, pattern) {
+    let previous;
+    let current = value;
+
+    do {
+        previous = current;
+        current = current.replace(pattern, "");
+    } while (current !== previous);
+
+    return current;
+}
+
 function assertWellFormedStructure(xml) {
     if (/&(?!amp;|lt;|gt;|quot;|apos;|#\d+;|#x[0-9a-f]+;)/i.test(xml)) {
         fail("the XML contains an unescaped ampersand");
     }
 
-    const withoutCommentsAndDeclaration = xml
-        .replace(/<!--[\s\S]*?-->/g, "")
-        .replace(/<\?[\s\S]*?\?>/g, "");
+    const withoutCommentsAndDeclaration = removeUntilStable(
+        xml,
+        /<!--[\s\S]*?-->|<\?[\s\S]*?\?>/g
+    );
 
     const tagPattern =
         /<\/?([A-Za-z_][\w:.-]*)(?:\s[^<>]*?)?\s*\/?>/g;