Update Quill version and enhance HTML escaping for security

[sbakshiakp]

• Bump Quill version to 1.3.7-snyk-fix.1 in package.json.
• Implement HTML escaping functions in html_escape.ts to prevent XSS vulnerabilities.
• Update Formula, Image, and Video formats to use escape functions for safe HTML output.
• Modify editor's convertHTML function to ensure safe wrapping of elements.
• Add tests to verify that HTML export correctly escapes potentially harmful content.

[chrissarnold]

Any idea when this might be approved, merged and made available

[0xLeif]

Review (via AI-assisted code review): REQUEST CHANGES

The escaping work itself is largely sound — the new html_escape.ts helpers (escapeAttribute covering & < > " ' plus newlines/tabs, stripDangerousAttributes removing on* handlers and javascript: URLs, marker-based safe wrapper reconstruction) correctly close the CVE-2025-15056 formula/video vectors, the data-language attribute breakout, and the convertHTML outerHTML.split() fragility; Video.html() also re-sanitizes the URL before export, which is better than the raw escape in some sibling PRs. But there are blocking problems:

1. Bogus version change. packages/quill/package.json version is changed from 2.0.3 to 1.3.7-snyk-fix.1. This looks like a Snyk-bot artifact, would downgrade the published package version, and must be reverted.

2. Unrequested, risky test-config change. test/unit/vitest.config.ts changes include/typecheck.include from resolve(__dirname, '**/*.spec.ts') to the relative 'test/unit/**/*.spec.ts', which only resolves correctly if vitest is invoked from packages/quill and breaks the config's location independence. Unrelated to the security fix; revert.

3. Output contract change in Formula.html(). The output changes from <span>...</span> to <span class="ql-formula">...</span>. Adding the class may be desirable, but it changes getSemanticHTML() output for every existing consumer and isn't justified by the security fix — split it out or call it out explicitly.

Other notes:

• Formula.html()'s typeof this.value() === 'string' branch is dead for embeds (value() returns { formula }); it always falls through to getAttribute('data-value'), which is correct but the dead branch is confusing.
• Image.html() correctly uses getAttribute('src') + Image.sanitize + the ATTRIBUTES allowlist via formats() — this is the cleanest of the three overlapping PRs on that front.
• Overlap: the syntax.ts line is identical to Fix XSS in semantic HTML export: escape code-block language #4818 and Fix: Security - XSS vulnerability in formula and video HTML export #4774; formula/video fixes overlap with Fix: Security - XSS vulnerability in formula and video HTML export #4774. Please coordinate so only one lands each hunk.
• No CI has run on this fork head; the new editor.spec tests should be verified in the suite.