Security fixes for variantopedia app #3817

[davmlaw]

🤖 Written by Claude

Fixes from security review of the variantopedia app (SACGF/variantgrid_private#3817).

Changes

Finding #1 — Replace .objects.get() with get_object_or_404()

• variant_tag_detail() — Variant
• export_classifications_allele() — Allele
• variant_details_annotation_version() — AnnotationVersion
• nearby_variants() — AnnotationVersion

Finding #3 — XSS via |safe in health check template

• All as_html() methods in library/health_check.py now use format_html() so user-controlled content (usernames, HGVS strings, email subjects in extra fields) is properly escaped before being marked safe.

Finding #4 — Missing authorization check in variant_tag_detail

• View: raises PermissionDenied if the user has no readable VariantTag for the requested variant+tag.
• Grid (VariantTagDetailColumns): applies VariantTag.filter_for_user() to the queryset so the datatable only returns tags the user has permission to see.