Merge commit from fork

* Fix popup rendering for new window outputs

* Encode filename in data URI, add edge case tests

- Encode options.filename in datauristring to prevent data URI
  structure corruption via semicolons/commas
- Add tests: SRI on default pdfobject URL, data URI filename encoding,
  malicious pdfJsUrl attribute injection attempt

* Fix SRI test: split into default and custom URL cases

The previous test claimed to cover both default and custom URL
paths but only checked the default. Now split into two separate
tests that each verify what they claim.

---------

Co-authored-by: Doruk <peak@peaktwilight.com>