fix: enhance security by blocking plugins with dangerous JS patterns and enforcing strict session secret length

lib/plugin-types.ts

@@ -427,6 +427,7 @@ export const ALLOWED_PLUGIN_FILES = new Set([
 export const DISALLOWED_CSS_PATTERNS = [
   /@import\b/i,
   /url\s*\(\s*['"]?https?:/i,
+  /url\s*\(\s*['"]?data:/i,
   /expression\s*\(/i,
   /javascript\s*:/i,
   /-moz-binding/i,