Security: Dynamic script injection in configLoader.ts creates XSS vulnerability

## Description
`configLoader.ts` fetches JavaScript from `config.js` and injects it
directly into the DOM using `innerHTML`, which creates an XSS vulnerability.

## Location
`configLoader.ts` lines 28-30

## Current Code
```ts
const configScript = document.createElement('script');
configScript.innerHTML = script; // dangerous
document.head.appendChild(configScript);
```

## Risk
If an attacker compromises the config endpoint or performs a
MITM attack, they can execute arbitrary JavaScript in the OpenShift
console context — potentially stealing auth tokens or accessing
cluster resources.

## Suggested Fix
Replace executable JS config with a JSON-based approach:
```ts
const response = await fetch('/config.json');
const config = await response.json();
```
This eliminates script injection entirely.

## Environment
- Kuadrant Console Plugin (main branch)