GHSA-97JJ-33GV-5XF9 league/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literal

Summary The DisallowedRawHtml extension does not escape a disallowed tag when the tag name is the last thing in the raw HTML. A Markdown line containing just /i The trailing character class requires one character after the tag name. The block parser does not: RegexHelper::PARTIALHTMLBLOCKOPEN...