Linter: Implement html-no-event-handlers and html-no-script-elements rules

[markokajzer]

closes #161

---

Rule: html-no-event-handlers

Description

Disallow the use of inline JavaScript event handler attributes (e.g. onclick, onload) in HTML templates.

Rationale

Inline JavaScript poses a significant security risk and is incompatible with strict Content Security Policy (CSP) configurations (script-src 'self').

All JavaScript should be included via external assets to support strong CSP policies that prevent cross-site scripting (XSS) attacks.

This rule enforces:

• No event handler attributes (onclick, onmouseover, etc.) on HTML elements.
• No event handler attributes on ActionView tag helpers (e.g. <%= tag.button onclick: "..." %>).

---

Rule: html-no-script-elements

Description

Disallow the use of inline <script> tags in HTML templates.

Rationale

Inline JavaScript poses a significant security risk and is incompatible with strict Content Security Policy (CSP) configurations (script-src 'self').

All JavaScript should be included via external assets to support strong CSP policies that prevent cross-site scripting (XSS) attacks.

This rule enforces:

• No <script> tags embedded directly in templates.

[marcoroth]

Thanks for working on this @markokajzer!

I think we want to keep the two rules separate so that the erb-no-javascript-tag-helper rule is strictly about avoid the javascript_tag Action View helper (should probably be renamed to actionview-no-javascript-tag-helper later).

And this rule should probably be just about inline script handler, for catching all the on* attributes. Both on the regular HTML element and on the ActionView tag helpers, like <%= tag.button onclick: "alert('hello')" %>. And we probably want to rename the rule to have a html-* prefix.

And then finally, we probably also want a third independent one that catches inline <script> HTML elements, either in the body or head.

[markokajzer]

changes:

1. restored erb-no-javascript-tag-helper
2. split out html-no-event-handlers
3. split out html-no-script-elements
4. both scan for action view helpers
5. added some additional specs with more edge cases

i can separate into two PRs 👍

gonna leave the rename to #1359, so noop for now