Fix remaining Snyk findings: XSS in validImageUrl, cipher integrity suppression

src/components/admin/media-grid.tsx

@@ -6,9 +6,10 @@ import { uploadMedia } from "@/actions/admin-media";
 type MediaFile = { name: string; url: string };
 
 function validImageUrl(url: string): string {
-  // Only allow relative URLs (starting with /) to prevent XSS via absolute URLs.
-  if (url.startsWith("/")) return url;
-  return "";
+  if (!url.startsWith("/")) return "";
+  if (/[<>"']/.test(url)) return "";
+  if (/(data|javascript|vbscript|file):/i.test(url)) return "";
+  return url;
 }
 
 export function AdminMediaGrid() {

src/components/admin/media-picker.tsx

@@ -6,9 +6,10 @@ import { uploadMediaAndReturn } from "@/actions/admin-media";
 type MediaFile = { name: string; url: string };
 
 function validImageUrl(url: string): string {
-  // Only allow relative URLs (starting with /) to prevent XSS via absolute URLs.
-  if (url.startsWith("/")) return url;
-  return "";
+  if (!url.startsWith("/")) return "";
+  if (/[<>"']/.test(url)) return "";
+  if (/(data|javascript|vbscript|file):/i.test(url)) return "";
+  return url;
 }
 
 export function MediaPicker({