fix: harden runtime file URL handling

[alekswebnet]

Summary

Small follow-ups from the review of #57 (individual runtime file URL attributes).

• Explicit attribute table. Attribute names were derived from object keys by a regex, so pdfjs-lib-src, viewer-css-src etc. appeared nowhere in the source, and renaming a key silently renamed a public attribute. DIST_FILE_NAMES and DEFAULT_RUNTIME_FILE_URLS are merged into one RUNTIME_FILES table that lists each file's attribute, dist file name and bundled default.
• Read runtime URLs once per build. buildViewerEntry (CSP and stylesheet links) and buildViewerApp (script injection) each re-read the attributes, with awaits in between. An attribute changed mid-build could produce a CSP for one origin and a script from another, which the CSP then blocks. A new buildViewer() reads the URLs once and passes them to both steps. It also replaces the init code that was duplicated in connectedCallback and the locale rebuild.
• Escape stylesheet URLs in the srcdoc. getFullPath returns the raw value when it isn't a valid URL, and that value went straight into <link href="...">. A value containing " could add markup to the viewer document. Both stylesheet hrefs are now attribute-escaped.
• README: all runtime files must come from the same package release as the element.

applyViewerOptions still reads worker-src live, because that attribute is meant to be updatable at runtime.

Not included

These change behavior, so they need a decision first:

• Resolving relative URLs against document.baseURI instead of location.href, for pages with <base href>. This would also change how src resolves.
• Making worker-src and the other four runtime file attributes behave the same way. Today only worker-src updates at runtime.

Tests

Three new tests:

• The CSP includes the origin of each override (pdfjs-lib-src, viewer-src, viewer-css-src, theme-css-src). Each one uses its own .invalid host, so no network access is needed.
• An attribute set right after connection doesn't change the build that is already running.
• An invalid theme-css-src containing markup stays a single href and injects nothing.

The last two fail without the fix. The full suite passes (20/20), and pnpm build succeeds.

🤖 Generated with Claude Code