fix: sanitize image src in ForumState HTML output

[uchia6861-tech]

Escape image URL attributes and add URL scheme validation
in _render_post_image() and the reply image block in to_html()
to prevent potential HTML injection via unsanitized src values.

Changes:

• Pass image src through _escape_html() before rendering into img attribute
• Add URL scheme allowlist (https://, http://, data:image/) to block javascript: URIs
• Applied consistently to both post images and reply images

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[uchia6861-tech]

@googlebot I have signed the CLA.

[uchia6861-tech]

@googlebot I have signed the CLA.

[uchia6861-tech]

fixed

[uchia6861-tech]

@google-deepmind/concordia-team Hi, I have signed the Google CLA at
cla.developers.google.com with my email uchia6861@gmail.com but the
cla/google check is still failing. Could a maintainer help resolve this?
Thank you.

[uchia6861-tech]

Hi team, I have a valid Google Individual CLA signed on May 3, 2026
with email uchia6861@gmail.com (GitHub account: uchia6861-tech) but
the cla/google bot check is still failing. Could a maintainer please
manually verify or override the CLA check? Thank you.