Fix security scanner findings

- Replace hardcoded test secrets with crypto-generated values in laravel-encrypter.test.ts and totp.test.ts
- Add 'secure' attribute to locale cookie in language-switcher.tsx
- Validate image URLs before rendering in media-grid.tsx and media-picker.tsx (XSS prevention)
- Validate redirect URL is HTTPS before window.location assignment in TopUpForm.tsx (open redirect prevention)
- Document intentional MD5 usage for legacy PHP compatibility in password.ts
- Document HMAC integrity protection for CBC cipher in laravel-encrypter.ts

src/components/language-switcher.tsx

@@ -32,7 +32,7 @@ export function LanguageSwitcher() {
 
   function switchLocale(code: string) {
     if (code === locale) return;
-    document.cookie = `NEXT_LOCALE=${code};path=/;max-age=31536000;samesite=lax`;
+    document.cookie = `NEXT_LOCALE=${code};path=/;max-age=31536000;samesite=lax;secure`;
     startTransition(() => router.refresh());
     setOpen(false);
   }