fix: resolve the open CodeQL alerts

Strip HTML tags and XML comments until the text no longer changes, so that
nested input cannot reassemble a tag or comment after a single pass
(js/incomplete-multi-character-sanitization in website/.eleventy.js and
website/scripts/validate-version-info.js).

Limit the GITHUB_TOKEN of the PR compile check and the test version-XML
workflow to read access (actions/missing-workflow-permissions).

Claude-Session: https://claude.ai/code/session_01FJBfPYm6rCH4zD6T7bcC7Y

website/.eleventy.js

@@ -32,11 +32,26 @@ const MANUAL_PAGE_ORDER = {
     ]
 };
 
+// Removes HTML tags until none are left, so that nested input such as
+// "<<b>script>" cannot reassemble a tag after a single pass.
+function stripHtmlTags(value) {
+    let previous;
+    let current = value;
+
+    do {
+        previous = current;
+        current = current.replace(/<[^>]+>/g, "");
+    } while (current !== previous);
+
+    return current;
+}
+
 function markdownToPlainText(value) {
-    return (value || "")
+    const withoutLinks = (value || "")
         .replace(/!\[([^\]]*)\]\([^)]+\)/g, "$1")
-        .replace(/\[([^\]]+)\]\([^)]+\)/g, "$1")
-        .replace(/<[^>]+>/g, "")
+        .replace(/\[([^\]]+)\]\([^)]+\)/g, "$1");
+
+    return stripHtmlTags(withoutLinks)
         .replace(/[*_~`]/g, "")
         .replace(/\s+/g, " ")
         .trim();