[pfefferle]

Split out of #3850.

Proposed changes:

• Remote posts and replies now have their HTML comments removed more thoroughly. An unclosed <!-- is removed up to the end of the content, and each removed comment is replaced by a space, so the text around it stays separate.
• The removal runs again after the HTML is cleaned, in Sanitize::content() and Sanitize::comment_content().

Other information:

• Have you written new tests for your changes, if applicable?

Testing instructions:

• Run npm run env-test -- --filter Test_Sanitize.
• Reply to a federated post from Mastodon and check that the reply still shows up as expected.

Changelog entry

• Automatically create a changelog entry from the details below.

Changelog Entry Details

Significance

• Patch
• Minor
• Major

Type

• Added - for new features
• Changed - for changes in existing functionality
• Deprecated - for soon-to-be removed features
• Removed - for now removed features
• Fixed - for any bug fixes
• Security - in case of vulnerabilities

Message

Improve the safety of imported Fediverse posts and comments.

The entry is already part of the branch.