fix: set httpOnly on JWT cookie and sanitize scriptJs to prevent stor… - #8051

## Description

Fixes a Stored XSS vulnerability in the scriptJs page field and sets httpOnly on the JWT
session cookie to prevent token exfiltration.

## Implementation Details

• server/helpers/common.js: Added httpOnly: true to getCookieOpts() — prevents
  client-side JS from reading the JWT cookie via document.cookie.
• server/models/pages.js: Strip <script tags from scriptJs before storage in both
  createPage and updatePage — blocks persistent XSS injection via GraphQL mutations.

## Scope of Impact

• Affects Wiki.js v2.5.296–v2.5.314.
• Users with write:pages + write:scripts permissions could inject persistent JS executed
  in any visitor's browser, enabling full account takeover.

## Changelog Highlight

Fixed Stored XSS in page scripts field; JWT cookie now flagged httpOnly.