Resolve open code scanning alerts

- Reference the shared workflow with the self-repository `$/` syntax
  (zizmor self-repository)
- Move the prettier hook to the maintained rbubley/mirrors-prettier mirror,
  since pre-commit/mirrors-prettier is archived (zizmor archived-uses)
- Make the <script> extraction regex in the docs app test case-insensitive
  (CodeQL js/bad-tag-filter)

Author: Kludex

.github/workflows/main.yml

@@ -11,7 +11,7 @@ permissions:
 
 jobs:
   checks:
-    uses: ./.github/workflows/shared.yml
+    uses: $/.github/workflows/shared.yml
 
   all-green:
     if: always()

.github/workflows/publish-pypi.yml

@@ -38,7 +38,7 @@ jobs:
           path: dist/
 
   checks:
-    uses: ./.github/workflows/shared.yml
+    uses: $/.github/workflows/shared.yml
 
   pypi-publish:
     name: Upload release to PyPI

.pre-commit-config.yaml

@@ -6,8 +6,8 @@ repos:
     hooks:
       - id: end-of-file-fixer
 
-  - repo: https://github.com/pre-commit/mirrors-prettier
-    rev: v3.1.0
+  - repo: https://github.com/rbubley/mirrors-prettier
+    rev: v3.9.10
     hooks:
       - id: prettier
         types_or: [yaml, json5]

tests/docs_src/test_apps.test.js

@@ -15,7 +15,7 @@ for (const [name, file] of cases) {
     const source = readFileSync(path.join(root, file), "utf8");
     const html = source.match(/CLOCK_HTML = """([\s\S]*?)"""/)?.[1];
     assert.ok(html);
-    const script = html.match(/<script>([\s\S]*?)<\/script>/)?.[1];
+    const script = html.match(/<script>([\s\S]*?)<\/script>/i)?.[1];
     const result = { content: [{ type: "text", text: "2026-06-26T12:00:00Z" }] };
     assert.ok(script);
     const clock = { textContent: "..." };