fix: address the two code scanning alerts

[mschmicking]

Two CodeQL alerts, with opposite conclusions.

test/fake-server.ts:143 — remote property injection (error)

Real dataflow. extendObject pulls partial out of a JSON-parsed websocket frame
and hands it to deepMerge, which writes dest[key] for every key in it, so a
frame carrying __proto__ would have rewritten the prototype rather than setting
a property.

Not a live exposure — the fake server exists only inside the test process and only
ever talks to this repo's own client — but the guard is one line, which beats a
suppression.

src/commands/types.ts:126 — network data written to file (warning)

I suggest dismissing this one as by-design. js/http-to-file-access flags any
remote data reaching the filesystem, and downloading javascript.d.ts into
.iobroker/types/ is precisely what iob-sync types is for. The URL is a
hardcoded HTTPS constant, the destination path is fixed, and a .d.ts is type
information tsc reads but never executes. There is no sanitizer for this rule, so
the alert will probably survive this PR.

It did point sideways at a real bug, though. res.ok is true for any 200 —
including the HTML login page a captive portal or corporate proxy serves. That page
was written straight over a working javascript.d.ts, and the failure surfaces
later as every script in the editor lighting up with TypeScript errors, with nothing
pointing back at iob-sync types.

So, three checks before the write: the announced content-length, the actual body
size, and whether the body contains a declaration at all. Each throws into the
existing catch, which already warns and keeps whatever copy is on disk — so a
portal response now leaves a good cached file intact instead of destroying it.

Known limit: the size cap bounds what reaches disk, not what reaches memory —
res.text() has already buffered the body by then. The content-length check
covers the honest-server case; a server lying about the length could still make the
process buffer a large body. Bounding that properly means streaming the response,
which seemed disproportionate here. Happy to add it if you disagree.

Tests

The download path had no coverage at all — the old file header said so outright. It
now has three cases against a stubbed fetch: the happy path, the portal case
asserting the good copy survives, and the oversize case asserting nothing is
written.

277 tests pass; ESLint and Prettier clean.

🤖 Generated with Claude Code