[ISSUE]: JS security helper depends on DOMPurify presence but can silently fall back insecurely #526

Description

initializeDOMPurify() returns null if DOMPurify is undefined and sanitizeForDisplay() falls back to HTML.escape(dirty). Escaping is safer for pure text, but the function is documented as “Sanitize user-generated content for display (removes all HTML)”. If dirty is later inserted with setElementContent(..., asHTML=true), it uses sanitizeForDisplay() and sets innerHTML = ... using the returned value. If DOMPurify is missing:
The fallback is escaped text, but then assigning escaped text to innerHTML still treats it as HTML entities. This is usually safe for escaped strings, but the risk is that developers may incorrectly assume sanitizeForDisplay always strips tags rather than only escaping; and other functions like sanitizeHTML() directly call DOMPurify.sanitize(...) without guarding DOMPurify existence.

Additional Context

Steps to reproduce:
Ensure DOMPurify is not loaded (e.g., remove/disable the script tag in the frontend page).
Call sanitizeHTML(dirty) somewhere in the app (or any code path using that function).
Observe runtime error or inconsistent sanitization behavior (depending on code path).
Also test setElementContent(element, "", true) and verify whether behavior is safe across app flows.