fix(SP-23180): prevent DOM XSS via innerHTML on search page title

[salkhwlani]

What kind of change does this PR introduce? (Bug fix, feature, docs update, ...)

• Security bug fix

What is the current behaviour? (You can also link to an open issue here)

• The q search query parameter is reflected into #page-main-title via innerHTML in src/assets/js/products.js, on the salla-products-list::products.fetched event. A crafted q value (e.g. /search?q=<span>...</span>) is rendered as live HTML, allowing DOM XSS on any storefront using this theme. Reported via Intigriti SALLA-38ORF9DB, confirmed on demostore.salla.sa.
• https://youtrack.salla.dev/browse/SP-23180

What is the new behaviour? (You can also link to the ticket here)

• The search page title is now set with textContent instead of innerHTML, so the raw q parameter can no longer be rendered as HTML/JS. The title was never intended to carry markup.
• https://youtrack.salla.dev/browse/SP-23180

Does this PR introduce a breaking change?

• No

Screenshots (If appropriate)

• N/A

Closes SAL-1340

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric	Results
Complexity	0
Duplication	✅ 0 (≤ 2 duplication)

View in Codacy

AI Reviewer: run a review on demand. To trigger the first review automatically, go to your organization or repository integration settings. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}