XSS sanitization and input validation

[PAMulligan]

Sanitize all user input and bot responses to prevent XSS. Use textContent-based approach from existing widget. Validate message length limits. Sanitize markdown links before rendering.