fix(ui): leave no angle bracket in a sanitized origin; judge markup on the raw one

sanitizeOrigin removed tags in a single pass, so `<scr<script>ipt>`
came out as `<script` (CodeQL js/incomplete-multi-character-sanitization
#6, #7). The page renders the result as React text, so this was not
exploitable here, but the helper's name promised more than it did. It
now also drops every remaining `<` and `>`.

validateOrigin looked for markup in the sanitized string, after the tags
had been removed, so `<b>x</b>` passed as a valid origin. It now checks
the raw origin first.

pr-any.yml gets permissions: contents: read and lock.yml the
issues/pull-requests/discussions write it needs (CodeQL
actions/missing-workflow-permissions #3, #23).

.github/workflows/lock.yml

@@ -5,6 +5,12 @@ on:
   schedule:
     - cron: '20 2/3 * * *'
 
+
+permissions:
+  issues: write
+  pull-requests: write
+  discussions: write
+
 jobs:
   lock:
     runs-on: ubuntu-latest

.github/workflows/pr-any.yml

@@ -1,6 +1,10 @@
 name: PR
 on: [pull_request]
 
+
+permissions:
+  contents: read
+
 jobs:
   pr:
     strategy: