Replace codemirror due to 3rd-party vulnerability CVE-2025-6493

Current Stuation

Currently JS7 JOC-Cockpit ships with codemirror 5.65.18 which is affected by CVE-2025-6493. The codemirror 3rd-party component is used for syntax highlighting in the Workflow Editor.

We rate the impact to our software as low as whatever is typed inside the script editor is treated as plain text for editing and highlighting, not as executable HTML/JavaScript. Even if someone pastes malicious HTML/JS code, it will never be executed inside the browser.

Desired Behavior

JS7 JOC Cockpit will replace codemirror by its own implementation. The usefulness of codemirror is is not in proportion to the attack surface offered considering the fact that updated versions of codemirror introduce additional 3rd-party libraries.