fix(security): harden sanitize, flatten, redaction, signature validation, CSP, proxies and CI

pdf-security.html

@@ -313,11 +313,17 @@
               Use the redaction tool in the
               <a href="/edit-pdf" class="text-indigo-300 hover:text-indigo-400"
                 >PDF Editor</a
-              >, which permanently removes the marked content from the page
-              instead of just covering it with a box. Redaction only deals with
-              what's on the page, so if the file's properties, comments, or
-              attachments could reveal the same information, run Remove Metadata
-              or Sanitize PDF on the result as well.
+              >. Marking text or an area only flags it. Once you apply the
+              redaction, the marked content is permanently removed from the page
+              instead of just being covered with a box, and if you download with
+              marks that haven't been applied yet, the editor offers to apply
+              them first. When you redact selected text, copies of it in the
+              file's properties, bookmarks, comments, and attachments are
+              removed on download too, unless the file is encrypted. Area
+              redactions have no text to search for, so if the file's
+              properties, comments, or attachments could reveal the same
+              information, run Remove Metadata or Sanitize PDF on the result as
+              well.
             </p>
           </details>
           <details class="faq-d">