fix(ui): address second round of PR review comments

- Replace hardcoded gap: 20px with var(--bui-space-5) in metadata row
- Trim leading whitespace from href before unsafe-scheme check to prevent bypass

Signed-off-by: Charles de Dreuille <charles.dedreuille@gmail.com>

packages/ui/src/components/Header/Header.module.css

@@ -68,7 +68,7 @@
     display: flex;
     flex-direction: row;
     align-items: center;
-    gap: 20px;
+    gap: var(--bui-space-5);
     flex-wrap: wrap;
   }
 

packages/ui/src/components/Header/Header.tsx

@@ -49,7 +49,9 @@ function renderInlineMarkdown(text: string): React.ReactNode[] {
     if (match.index > last) {
       parts.push(text.slice(last, match.index));
     }
-    const href = match[2];
+    // Trim leading whitespace/control chars before scheme check to prevent
+    // bypass via inputs like " javascript:alert(1)".
+    const href = match[2].trimStart();
     const label = match[1];
     if (UNSAFE_HREF_RE.test(href)) {
       parts.push(label);