fix(security): XSS via HTML attributes and code blocks

[peaklabs-dev]

Issue

Attribute values (href, src, alt, class, id) and un-highlighted code blocks were interpolated into HTML without escaping, so markdown input could break out of an attribute and cause an XSS injection.

new Markdown()->parse('[click](https://evil.co" onclick="alert(1))')->html;
// before: <p><a href="https://evil.co" onclick="alert(1">click</a>)</p>
// after:  <p><a href="https://evil.co&quot; onclick=&quot;alert(1">click</a>)</p>

Changes

• Escape HTML attribute values in token rendering
• Escape code blocks with highlighter: null
• Generate a proper slug for auto heading IDs
• Expand heading auto slugs to non-Latin languages

[github-actions]

Benchmark Results

Comparison of fix/parser-hardening against main (81d9dcb9288ef1d18f40c4a36ec8379377417ca9).

Open to see the benchmark results

Benchmark	Set	Mem. Peak	Time	Variability
MarkdownBench(benchTempest)	01-small	3.708mb +0.02%	0.337ms +9.76%	±2.06% +125.95%
MarkdownBench(benchTempest)	02-large	6.755mb +0.27%	18.885ms +11.99%	±0.50% +126.69%

_{Generated by phpbench against commit 29b9404}

[brendt]

Looking great! Thanks