Add UseRenderModeInsteadOfPrimitives cop

[akabiru]

https://community.openproject.org/wp/75389

What this cop does

Flags format_text(...) calls that pass the external-rendering primitive flags — static_html: true, plain_text: true, or only_path: false — instead of the canonical render_mode: API. Suggested fix: render_mode: :external_html / render_mode: :external_text, or format_mail_html / format_mail_text inside mailer templates.

Why now

format_text renders trusted Markdown for two distinct audiences: in-app HTML and external surfaces (mailer bodies, feeds). External surfaces need absolute URLs and a subset of macros pre-resolved to static HTML / plain text, because the recipient has no JavaScript runtime to hydrate the rest. Expressing that requirement as three loosely coupled toggles makes call sites easy to get partially right and silently wrong.

openproject#23337 introduced the render_mode: API and the mailer view helpers as the structural fix; this cop prevents regression.

Scope and behaviour

• Fires on both .rb and .erb sources — OpenProject's .erb_lint.yml inherits .rubocop.yml, so mailer templates are covered automatically.
• Honors render_mode: as an explicit escape hatch: if the call already passes render_mode:, the primitive flags are treated as an intentional override and no offense is raised.
• v1 is flag-only. Autocorrect is deferred — static_html: true, only_path: false collapses to a single kwarg whose source range may not be contiguous.

Preview of offenses on opf/openproject dev

Smoke-test against a dev:

app/views/common/feed.atom.builder:72            format_text(item_event, :event_description, only_path: false)
app/views/journals/index.atom.builder:65         format_text(change, :notes, only_path: false)
app/views/user_mailer/message_posted.html.erb:35 format_text @message.content, object: @message, only_path: false
app/views/user_mailer/news_added.html.erb:33     format_text @news.description, only_path: false
app/views/user_mailer/news_comment_added.html.erb:34 format_text @comment.text, only_path: false

[oliverguenther]

Nice, thanks @akabiru 👏