Apply suggestions from code review

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Author: asgerf

javascript/ql/src/change-notes/2025-11-26-response-default-content-type.md

@@ -1,5 +1,5 @@
 ---
 category: minorAnalysis
 ---
-* `new Response(x)` is not longer seen as a reflected XSS sink when no`content-type` header
+* `new Response(x)` is not longer seen as a reflected XSS sink when no `content-type` header
   is set, since the content type defaults to `text/plain`.

javascript/ql/test/query-tests/Security/CWE-079/ReflectedXss/response-object.js

@@ -1,6 +1,6 @@
 const express = require('express');
 
-// Note: We're using express for the taint source in order to to test 'Response'
+// Note: We're using express for the taint source in order to test 'Response'
 // in isolation from the more complicated http frameworks.
 
 express().get('/foo', (req) => {