Fix web security issues in dashboard, detector, and CORS (#146)

Fix web security issues in dashboard, detector, and CORS (#146)

- Escape the client-supplied model string before rendering it into the
  dashboard logs table, preventing stored XSS in the dashboard origin.
- Bound the variable-name run in the ENV_PASSWORD and ENV_SECRET regexes
  to {0,128} to remove quadratic backtracking (ReDoS) on long inputs.
- Exclude the same-origin dashboard routes from the wildcard CORS policy
  so its unauthenticated JSON APIs are no longer readable cross-origin,
  while keeping permissive CORS for the proxy and mask APIs.