docs: fix NG05201 error page trigger and add it to the overview

The NG05201 page said the error is thrown when binding an untrusted value
to a resource URL attribute such as `<iframe [src]>`, but template and
host bindings are checked by core and throw NG0904. NG05201 only comes
from calling `DomSanitizer.sanitize()` with `SecurityContext.RESOURCE_URL`.

Rewrite the page around the direct `sanitize()` call, link to NG0904 for
bindings, align its structure with the NG0904 page, and add NG05201 to
the errors overview.

Author: MeAkib

adev/src/content/reference/errors/NG05201.md

@@ -1,43 +1,34 @@
-# Unsafe value used in a resource URL context
+# Unsafe resource URL passed to DomSanitizer
 
-Angular throws this error when you bind a value to an attribute that loads an external resource — like `<iframe src>`, or `<link href>` — and that value hasn't been explicitly marked as trusted.
+Angular throws this error, with the message `unsafe value used in a resource URL context`, when `DomSanitizer.sanitize()` is called with `SecurityContext.RESOURCE_URL` and a value that hasn't been explicitly marked as trusted.
 
-Resource URLs are treated differently from regular URLs. Angular can sanitize a plain URL (stripping `javascript:` schemes and so on), but it can't make an arbitrary resource URL safe because these attributes cause the browser to fetch and execute external content. So Angular rejects untrusted values rather than trying to sanitize them.
+Resource URLs are treated differently from regular URLs. Angular can sanitize a plain URL, but it can't make an arbitrary resource URL safe because resource URL attributes, like `<iframe src>` or `<link href>`, cause the browser to fetch and execute external content. So `sanitize()` rejects untrusted values rather than trying to sanitize them.
 
-The attributes that trigger this check are:
-
-| Element    | Attribute(s)       |
-| ---------- | ------------------ |
-| `<base>`   | `href`             |
-| `<embed>`  | `src`              |
-| `<frame>`  | `src`              |
-| `<iframe>` | `src`              |
-| `<link>`   | `href`             |
-| `<object>` | `codebase`, `data` |
+Binding an untrusted value to one of these attributes in a template or host binding throws [NG0904](errors/NG0904) instead.
 
 ## Debugging the error
 
-This error can also be thrown when calling `DomSanitizer.sanitize()` directly with `SecurityContext.RESOURCE_URL` and a plain string:
-
-```typescript
-inject(DomSanitizer).sanitize(SecurityContext.RESOURCE_URL, 'https://example.com'); // throws NG05201
-```
-
-`sanitize()` cannot make an arbitrary string safe in a resource URL context. Either use `bypassSecurityTrustResourceUrl` if the value is fully under your control, or bind the value to a regular URL attribute that Angular can sanitize.
-
-Look for a binding to one of the attributes above or a direct `sanitize()` call:
+Look for a `sanitize()` call that uses `SecurityContext.RESOURCE_URL`. The error is thrown for any plain string, even a static-looking URL:
 
-```html
-<iframe [src]="userUrl"></iframe>
+```angular-ts
+@Component({
+  selector: 'app-root',
+  template: `<iframe [src]="url"></iframe>`,
+})
+export class App {
+  private readonly sanitizer = inject(DomSanitizer);
+  url = this.sanitizer.sanitize(SecurityContext.RESOURCE_URL, 'https://example.com/embed'); // throws NG05201
+}
 ```
 
-If the URL comes from a trusted, controlled source, mark it safe using `DomSanitizer.bypassSecurityTrustResourceUrl`:
+If the URL comes from a trusted, controlled source, mark it safe using `DomSanitizer.bypassSecurityTrustResourceUrl` and bind the result directly:
 
-```typescript
+```angular-ts
 import {DomSanitizer, SafeResourceUrl} from '@angular/platform-browser';
 
 @Component({
-  selector: 'my-app',
+  selector: 'app-root',
+  template: `<iframe [src]="safeUrl"></iframe>`,
 })
 export class App {
   safeUrl: SafeResourceUrl = inject(DomSanitizer).bypassSecurityTrustResourceUrl(
@@ -46,8 +37,6 @@ export class App {
 }
 ```
 
-```html
-<iframe [src]="safeUrl"></iframe>
-```
+CRITICAL: `bypassSecurityTrustResourceUrl` is an escape hatch, not a sanitizer. Never pass user-supplied URLs through it — that would allow an attacker to load arbitrary content, including malicious scripts. Only use it when the value is fully under your control.
 
-`bypassSecurityTrustResourceUrl` is an escape hatch, not a sanitizer. Never pass user-supplied URLs through it — that would allow an attacker to load arbitrary content, including malicious scripts. Only use it when the value is fully under your control.
+For more information, see the [Security guide](best-practices/security#trusting-safe-values).

adev/src/content/reference/errors/overview.md

@@ -51,6 +51,7 @@
 | `NG05000` | [Hydration with unsupported Zone.js instance.](errors/NG05000)                       |
 | `NG05104` | [Root element was not found.](errors/NG05104)                                        |
 | `NG05106` | [Insertion reference node not found](errors/NG05106)                                 |
+| `NG05201` | [Unsafe resource URL passed to DomSanitizer](errors/NG05201)                         |
 | `NG05703` | [Suspicious URL origin change during SSR](errors/NG05703)                            |
 
 ## Compiler errors