Security: close final 2 open CodeQL alerts on nextcloud-vue

[rubenvdlinde]

Context

PRs nextcloud-vue#244 (5 alerts), #247 (4 alerts), #249 (js/bad-tag-filter) closed a wave of GitHub Advanced Security findings today. API check confirms 2 alerts still open:

gh api repos/ConductionNL/nextcloud-vue/code-scanning/alerts --jq '[.[] | select(.state=="open")] | length'
# => 2

Action

• Identify the 2 remaining alerts
• Land fix(es) against beta
• Verify clean before the beta→main promotion (#123) — see related issue "Release: promote nextcloud-vue beta 1.0.0 → main"