[BUG FIX] fix memory leakage & object properties exposure & TTP xml parse fallback to null

[cyfung1031]

Description

This PR fixes three closely related issues in the GM_xmlhttpRequest implementation to improve compatibility with Tampermonkey (TM), prevent memory leaks, and handle Trusted Types Policy (TTP) environments safely.

Changes

• Non-enumerable response getters
  response, responseText and responseXML are now defined with non-enumerable getters (enumerable: false), matching Tampermonkey behavior.
  This prevents Object.assign({}, response), JSON.stringify(response), or similar operations from unintentionally triggering getters or exposing internal state.

• Memory leak fix via weak references
  Internal state is now managed through a WeakMap. Getters are attached lazily only after readyState === 4.
  This allows the garbage collector to reclaim memory once the consumer no longer references the response/XHR object, eliminating closure-induced leaks.

• Safe fallback for responseXML in TTP-restricted pages
  When DOMParser.parseFromString() fails due to Trusted Types violations (or other parse errors), responseXML now returns null instead of throwing.
  This matches Tampermonkey's observed behavior in restricted environments.

Related issues

• Closes [BUG] 未与 TM 对齐： DOMPraser 失败时 responseXML 应设为 null 而非 crash #1240
• Closes [BUG] response, responseXML, ... 的 enumerable 及 configurable 未与 TM 对齐 #1241

#1239 is a combination symptom of #1240 + #1241 (only reproducible when both conditions are met)

Important notes

• This PR does not attempt to bypass or work around Trusted Types restrictions.
• Scriptcat aligns strictly with Tampermonkey & Violentmonkey behavior in TTP-protected pages.
• No new dependencies or large refactors — change is localized to the GM_xmlhttpRequest logic.

[Copilot]

Pull request overview

此 PR 修复了 GM_xmlhttpRequest 中三个相关问题，以提高与 Tampermonkey 的兼容性、防止内存泄漏并在 Trusted Types Policy 环境中安全处理错误。

主要变更：

• 将 response、responseText 和 responseXML 改为不可枚举的 getter（enumerable: false），匹配 Tampermonkey 行为，防止 Object.assign 或 JSON.stringify 意外触发 getter
• 通过 WeakMap 管理内部状态，实现自动垃圾回收，解决闭包导致的内存泄漏
• 在 TTP 受限页面中，当 DOMParser.parseFromString() 失败时，responseXML 返回 null 而非抛出异常

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
src/app/service/content/gm_api/gm_xhr.ts	核心修复：重构 XHR 响应对象创建逻辑，使用 WeakMap + 非枚举 getter，添加 DOMParser 错误处理，优化异步处理器以避免闭包泄漏
example/tests/gm_xhr_test.js	添加 objectProps 测试辅助函数，验证响应对象属性不会通过 Object.assign 或 JSON.stringify 暴露内部状态