Add html filtering

[JoannaaKL]

This PR:

• adds a dependency to microcosm-cc/bluemonday for html sanitization
• adds a function that will sanitise html tags
• uses the above to sanitise pull requests and issues

Misc updates:

• github.com/microcosm-cc/bluemonday
• script/licenses and script/licenses-check were updated to use GOFLAGS=-mod=mod which will ignore the vendor directory. The report template uses the LicenseURL field, but it’s being populated with links to this repo’s vendored paths because the tool is running in vendor mode by default when a vendor/ directory exists. By adding GOFLAGS=-mod=mod vendor directory is ignored and the upstream module url is used as expected.

[Copilot]

Pull Request Overview

This PR adds HTML sanitization capabilities to prevent XSS attacks and other security issues when handling user-provided content. It introduces the bluemonday library to sanitize HTML tags in GitHub issue and pull request titles and bodies.

• Integrates bluemonday library for HTML sanitization with a configurable policy
• Updates sanitization logic to filter both invisible characters and HTML tags
• Adds comprehensive test coverage for the new HTML filtering functionality

Reviewed Changes

Copilot reviewed 14 out of 15 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
pkg/sanitize/sanitize.go	Adds FilterHTMLTags and Sanitize functions with bluemonday policy configuration
pkg/sanitize/sanitize_test.go	Adds comprehensive test cases for HTML tag filtering
pkg/github/issues.go	Updates to use Sanitize instead of FilterInvisibleCharacters
pkg/github/pullrequests.go	Updates to use Sanitize instead of FilterInvisibleCharacters
go.mod	Adds bluemonday and its dependencies
go.sum	Updates checksums for new dependencies
third-party-licenses.*.md	Adds license entries for new dependencies
third-party/*/LICENSE*	Adds license files for new third-party dependencies
script/licenses	Adds GOFLAGS=-mod=mod to go-licenses commands
script/licenses-check	Adds GOFLAGS=-mod=mod and fixes echo to printf

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The nil check for policy is not thread-safe and could result in multiple goroutines initializing the policy simultaneously. Consider checking if policy is nil inside policyInit() only, or use policyOnce.Do() directly in FilterHTMLTags to ensure initialization happens exactly once.

[Copilot]

[nitpick] Only allowing HTTPS URLs is a good security practice, but this may be overly restrictive for certain use cases like mailto: links or relative URLs. Consider if this aligns with product requirements, or document this intentional restriction.

Suggested change

	p.AllowURLSchemes("https")
	p.AllowURLSchemes("https", "mailto")