Harden docbook branding scripts.js (CodeQL high alerts)

[vharseko]

Summary

Fixes all high-severity CodeQL alerts in the docbook branding stylesheet commons/doc-default-branding/.../docbkx-stylesheets/bootstrap/scripts.js (a generated-documentation asset). Six alerts across three rules, all in this one file.

Changes

• js/insecure-download (#2031, #2032, #2033) — three $.getScript() calls fetched executable JavaScript from cdnjs.cloudflare.com over plain HTTP, which is open to man-in-the-middle tampering. Switched to HTTPS; cdnjs serves the same paths over TLS.
• js/xss-through-dom (#2034, #2035, #2036) — wrapConfigurablesFn read an element's text with .text() and re-inserted it with .html(), so any &, < or > in the text was reinterpreted as markup. The text is now passed through a small escapeHtml() helper before the example strings are wrapped.
• js/incomplete-hostname-regexp (#2039) — the example host was used directly as a RegExp, so its dots matched any character. The pattern is now built through an escapeRegExp() helper so the literal string is matched literally.

Verification

Node smoke test on the patched file:

• the file parses;
• HTML metacharacters (<b>, <script>, &) in the source text are escaped;
• the example strings are still wrapped in their styled spans (behaviour preserved);
• the escaped host pattern no longer matches unrelated hosts (e.g. openamXexampleYcom).