[Demo][Security] Fix reflected XSS in promo banner

## Demo goal
Show a security finding and Copilot remediation workflow.

## Problem
`demo-app/public/app.js` sets promo text using `innerHTML` from URL query param `promo`.

## Requested change
- Replace unsafe rendering with safe text-only rendering
- Add input constraints for promo length
- Document expected behavior for benign/unsafe input

## Presenter cue
Use this issue for Defender + GitHub Code Security remediation narrative.

## Files
- `demo-app/public/app.js`

Start with demo-app/public/app.js and trace how the promo query parameter is rendered. Replace the unsafe HTML rendering with text-only behavior, enforce the requested promo length constraint, and document how benign and unsafe inputs should behave. Done means promo content cannot be interpreted as HTML and the expected behavior is documented.

Written by the indexing model from the issue text.