fix: validate hex colours in hexColor() to prevent XML injection

[simongdavies]

hexColor() previously did no validation — just stripped '#' and uppercased. If a non-hex string (like gradient XML) was passed, it was silently embedded as an srgbClr val attribute, producing corrupt OOXML that PowerPoint would repair by stripping entire slides.

Bug reproduction: LLM passes gradient XML or background XML as a 'color' parameter → hexColor uppercases it → solidFill embeds it as <a:srgbClr val='<P:BG>...'/> → PowerPoint repair strips the slide.

Fix: hexColor() now validates input against /^#?[0-9A-Fa-f]{6}$/ and throws a descriptive error on invalid input, matching the same regex used by requireHex(). Error message truncates long strings to avoid dumping XML fragments into the console.

[Copilot]

Pull request overview

This PR hardens the ha:doc-core builtin module by validating hex colour inputs in hexColor() to prevent malformed OOXML (and potential XML injection via attribute values) when non-hex strings are passed.

Changes:

• Added runtime validation to hexColor() and throws a descriptive error on invalid 6-char hex inputs.
• Updated the ha:doc-core type docs to reflect the new validation/throw behavior.
• Updated doc-core.json hashes to match the modified source/types output.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 4 comments.

File	Description
builtin-modules/src/doc-core.ts	Adds validation + error message behavior to hexColor() to block non-hex strings from being embedded into OOXML.
builtin-modules/src/types/ha-modules.d.ts	Updates the exported docs for hexColor() in the generated ha:* module typings.
builtin-modules/doc-core.json	Refreshes module metadata hashes after the doc-core source/types change.