Bump the bundled UI versions (Scalar 1.66.1, Swagger UI 5.32.14)

[FumingPower3925]

Supersedes #124 (the Dependabot all-ui-bundles group PR, which only edits package.json).

package	from → to
@scalar/api-reference	1.65.1 → 1.66.1 (minor)
swagger-ui-dist	5.32.13 → 5.32.14

Updated across all pin sites: CDN version + SRI in ui/scalar and ui/swaggerui, embedded version + //go:generate URLs + re-vendored assets + hash pins in ui/scalaremb and ui/swaggeruiemb, and the package.json tracker.

Supply-chain verification

• Provenance: both carry npm signatures and SLSA build provenance — Scalar from github.com/scalar/scalar, swagger-ui-dist from github.com/swagger-api/swagger-ui, subjects matching the exact versions.
• Integrity: each tarball's sha512 matches the published dist.integrity; jsDelivr is byte-identical to the tarball for Scalar's standalone.js and both of Swagger's assets; SRIs recomputed from those bytes.
• Swagger: external-host set unchanged.
• Chains: both are current @latest; no republished or unpublished versions.

Three things that needed classifying, and what they turned out to be

1. Scalar's host set gains one entry: scratch. It is new URL("http://scratch") — the throwaway base a path helper passes to the URL parser so it can build hash/pathname strings. The function returns i.hash/i.pathname, never i.href, and never fetches; "scratch" is not a resolvable TLD, and connect-src 'self' would block it regardless.

2. Scalar's atob( count rises 4 → 6. The bundle now carries two copies of Zod (4.3.5 and 4.4.3); the two extra calls are that second copy's identical base64() and jwt() format validators, which decode only to return a boolean. This also accounts for part of the +95 KB.

3. Where 1.66.0 went. It is in the changelog but was never published to npm — no versions{} entry and no time{} entry (npm keeps a timestamp even for unpublished versions, and this package has zero unpublished versions in its history). 1.66.1's sole change is "Republish every package through npm trusted publishing. No functional changes," which is also what produces its provenance.

Everything else held: eval/new Function/WebSocket/document.cookie/sendBeacon/importScripts all remain at zero, localStorage and XMLHttpRequest counts are unchanged, and data-url/data-configuration plus the CSP-safe config keys are intact.

Note: both upstreams now emit a sourceMappingURL. It is relative — on the CDN variants devtools may fetch the map from the already-allowed jsDelivr origin; on the embedded variants it 404s harmlessly, since we deliberately vendor only the bundle (Scalar's map alone is 14.7 MB).

Verification

• gofmt/vet/build/go test -race ./.../golangci-lint clean; all four pinning, embedded-integrity, and package.json parity tests pass.
• uismoke renders all nine UIs under the enforced CSP plus all eight config variants. Both bumped UIs were screenshotted — Scalar's reworked anchor-link sidebar renders correctly, and the CSP-safe defaults still hide the phone-home chrome.

[FumingPower3925]

CI on this branch is red, but not because of the bump: all four bumped UI packages pass, and clean main (44d8b0b, without this change) fails the same two tests under Go 1.27.0. Go 1.27 went stable today and the version matrix derives from go.dev, so it joined the matrix on its own.

Tracked in #126. This stays open until that lands, then rebases onto it — the required CI OK check blocks the merge in the meantime anyway.

The supply-chain verification here is unaffected and stands.