Potential fix for code scanning alert no. 1: DOM text reinterpreted as HTML

[softberries]

Potential fix for https://github.com/softwaremill/semantic-ai-validator/security/code-scanning/1

To fix the problem, the insertion of the untrusted file name into the DOM must be performed safely. The best practice is to either:

• Use textContent (or innerText) to insert untrusted or dynamic strings, as it escapes content by default, OR
• Properly HTML-escape the value before assigning to innerHTML.

For this scenario, the most straightforward fix is to avoid innerHTML where not strictly necessary. We can clear and construct the information using plain text nodes and DOM manipulation (e.g., textContent) so that no part of the file name can be interpreted as markup. If some markup (such as the 📄 emoji or extra <span> for oversize) must still be included, only the static/known-safe markup should be inserted with innerHTML, while the untrusted content is injected using textContent or as a DOM node.

Specifically:

• On line 88, replace fileInfo.innerHTML = ... with logic that sets file info using textContent for file.name.
• For the oversize warning (line 92), append the <span> element created with textContent, not via concatenated HTML.

No new imports are needed. The changes are limited to the logic interacting with the file name when constructing the DOM for file info.

---

Suggested fixes powered by Copilot Autofix. Review carefully before merging.