[chore][core] enable security lint rules

[ar2rsawseen]

Turns on a set of security-relevant ESLint rules. Every rule was measured against this
tree first, and the count sits in .eslintrc.json next to each decision so the trade is
on the record rather than assumed.

Enabled at error — 0 reports each, so the cost is only a forward gate

no-proto, no-implied-eval, no-new-func, no-script-url,
security/detect-child-process, security/detect-eval-with-expression,
security/detect-pseudoRandomBytes.

detect-child-process is the interesting one. It exempts the destructured
const {spawn} = require('child_process') that 24 files here use, and fires on a
non-literal first argument to exec() — which is exactly the pattern CLAUDE.md tells
people to avoid. There are none today, so it costs nothing and holds the line.

Enabled at warn — real findings, but clearing them is a code change

rule	reports	where
security/detect-unsafe-regex	26 across 16 files	mostly api/utils/common.js
no-unsanitized/property	14 across 6 files	non-literal innerHTML writes in frontend code

Each needs a read to separate a real problem from a bounded one, so they are surfaced
rather than either blocking the build or being silenced at 40 sites.

Left off, with the measurement recorded

guard-for-in — 454 reports here. Measured against the tree, 6.2% of them (28) sit
on a loop that actually contains a prototype-reaching write, and those 28 are found by
the same two predicates no-prototype-pollution-sink already uses. So it adds no
coverage over that rule while adding 454 reports, and it misses the sinks that motivated
it, because a lone if/else loop body satisfies it.

security/detect-object-injection — fires on nearly every obj[key] read.
security/detect-non-literal-fs-filename — 145 reports, dominated by legitimate path
building in Gruntfile, countlyFs and the upload handlers.
security/detect-non-literal-require — 19 reports, all the plugin loader doing what a
plugin loader does.

CI

The ESLint step installs its own eslint rather than using devDependencies, so the two
new plugins are named on that line too; without it the run fails with "Failed to load
plugin". They are also added to devDependencies so a local npm install covers them.

Verification

npx eslint . — the exact command CI runs — exits 0 with 0 errors. Warnings go 81 -> 121.
Re-checked with the versions pinned in the workflow (eslint 8.57.0, security 3.0.1,
no-unsanitized 4.0.2), same result.

Test-merges cleanly with #7923.

🤖 Generated with Claude Code

---

Two exemptions added after the measurement

The error-level counts above were taken when this branch was written. Two test files landed on master since, and each is deliberately the thing a rule forbids:

• test/unit-tests/frontend.segmentation-value-prototype.js lifts functions out of a non-module frontend file and evaluates them by name. It already disabled no-eval; security/detect-eval-with-expression names the same five calls.
• test/unit-tests/plugins.star-rating.consent-link-scheme.js holds a table of urls the consent link must refuse. The script schemes are the fixtures — nothing navigates to them.

Both are scoped to the block that needs them and carry the reason. No production code is exempted.