[Nexucis]

Description

Important

Draft: blocked by perses/shared#440, which adds common.#linkURL. Until it's released, the CI can't resolve it.
Once released:

• bump github.com/perses/shared/cue to the release in table, tracetable, tracingganttchart and canvas, and add it to scatterchart (cue mod get github.com/perses/shared/cue@<version> in each of them).

Since perses/perses#4696, the Perses API rejects the dashboard and panel links whose URL uses a scheme that could run a script in the Perses origin (javascript:, data:, vbscript:, ...). The URL fields of the plugins are still plain strings, so the API accepts and stores these URLs in:

• Table: columnSettings[].dataLink.url
• TraceTable: links.trace
• TracingGanttChart: links.trace and links.attributes[].link
• ScatterChart: link
• Canvas: nodes[].url

The UI doesn't follow them (sanitizeUrl since #910 / #912, #925 for Canvas, and ScatterChart only navigates within the app), but the guarantee only lives in the UI. These fields now use common.#linkURL, so a dashboard using a disallowed scheme is rejected when it's saved. A URL whose scheme comes from a variable is still accepted: only the UI can verify it, once the variables are interpolated.

Compatibility: a dashboard that already stores such a URL can't be saved until the URL is fixed. That includes Canvas node URLs using a scheme outside the list (e.g. ssh://), which Canvas opened until #925.

Docs: the model docs of Table and TraceTable describe the rule. The TracingGanttChart links and the ScatterChart link weren't documented, they are now.

Tests:

• Each field has an invalid fixture (javascript:, also obfuscated with mixed case, a leading space or a tab, and data:). Table data links and Canvas node URLs get a valid fixture, the other fields already had one.
• percli plugin test-schemas (perses main) passes on each plugin with the CUE of [ENHANCEMENT] Add the #linkURL CUE definition to validate the URL of links shared#440 vendored the way percli plugin build does: table 27, tracetable 2, tracingganttchart 4, scatterchart 2, canvas 2 tests. Replacing common.#linkURL with string makes each new invalid fixture fail.
• make checkformat-cue, make checklicense and oxfmt --check on the fixtures pass. mdox fmt --check passes on the updated docs, except docs/table/model.md which already fails on main (unrelated to this change).

Screenshots

N/A

Checklist

• Pull request has a descriptive title and context useful to a reviewer.
• Pull request title follows the [<catalog_entry>] <commit message> naming convention using one of the
  following catalog_entry values: FEATURE, ENHANCEMENT, BUGFIX, BREAKINGCHANGE, DOC,IGNORE.
• All commits have DCO signoffs.

UI Changes

• Changes that impact the UI include screenshots and/or screencasts of the relevant changes.
• Code follows the UI guidelines.

No UI change.