fix(security): sanitize verbatim HTML output to prevent XSS

[capy-ai]

This PR adds allowlist-based HTML sanitization to replaceUrls in src/formatters.nim to prevent XSS attacks from unsanitized verbatim rendering in Finch view templates.

Changes

src/formatters.nim

• Add sanitizeHtml* proc that parses HTML with htmlparser, walks the tree, strips dangerous tags/attributes, and re-serializes safe output
• Define tag allowlists (allowedHtmlTags), denylists (dangerousHtmlTags), void tags (voidHtmlTags), and attribute allowlists (allowedHtmlAttrs)
• Validate href and src attributes to only permit http://, https://, or rooted relative paths (no javascript:, data:, or vbscript:)
• Update replaceUrls* to call sanitizeHtml(body) first, ensuring all content passing through it is sanitized before domain rewriting
• Handle edge cases: empty strings, parsing errors, and recursive tree walking for nested elements

All existing verbatim replaceUrls(...) call sites (tweet bodies, quote tweets, community notes, user bios) are now automatically protected without modifying the view templates.