Validate map url for agenda printing

[marwoodandrew]

Purpose

Validates the map URL passed on printing to prevent XSS vulnerability

What has changed

Addition of a Validation function on the passed map parameter, also remove the "safe" from the jinja template variable usage.

Steps to test

Ensure that the printed event include a map if enabled.

Checklist

• This pull request is not adding new forms that use redux
• This pull request is adding missing TypeScript types to modified code segments where it's easy to do so with confidence
• This pull request is replacing lodash.get with optional chaining for modified code segments

Resolves: #SDAN-769

[Copilot]

Pull request overview

This PR hardens agenda-item print rendering by validating the map URL query parameter server-side and removing unsafe template rendering to reduce XSS risk when embedding the static map image.

Changes:

• Add a map URL validator to AgendaItemParams that enforces a Google Static Maps prefix and a parameter allowlist.
• Remove the Jinja | safe filter and quote the src attribute when rendering the map image.
• Add tests covering accepted map rendering and rejection of invalid prefixes/characters/parameters.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
tests/core/test_agenda.py	Adds print/map rendering and validator rejection tests.
newsroom/templates/agenda_item_print.html	Removes safe usage and quotes src to rely on autoescaping.
newsroom/agenda/views.py	Introduces map URL validation/normalization and allowlisted query parameters.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.