test(visualization): use HTMLParser instead of a tag regex in injection test

CodeQL py/bad-tag-filter: the case-sensitive script-tag regex could miss
uppercase tags; collect start tags with html.parser instead.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FmPUotoqsNWWt3b41FMjwv