Fix HTML tags appearing in wiki table of contents

[heathdutton]

Fixes #36106

When wiki headings contain HTML elements (like <a name="anchor"></a>), the raw HTML code was appearing verbatim in the table of contents instead of being stripped out.

This fix uses bluemonday.StrictPolicy() to sanitize the heading text before adding it to the ToC, removing all HTML tags while preserving the text content.

Before: ToC displays <a name="asdf"></a> has strange html
After: ToC displays has strange html

[lunny]

Could you add some test?

[lunny]

Whether any a tag in the heading should be ignored or we could have an option to do that?

[heathdutton]

Good question! I went with stripping all HTML tags rather than just <a> specifically - the ToC should really just show plain text for navigation, so things like <span>, <strong>, etc. wouldn't make sense there either.

The heading itself still renders with the HTML in the document body, so anchor links like <a name="anchor"> still work fine for linking purposes.

I think adding an option would be overkill for this - can't think of a case where someone would actually want raw HTML showing up in their ToC. But happy to discuss if you see it differently!

[delvh]

can't think of a case where someone would actually want raw HTML showing up in their ToC

What about case <a> and <b>?

[delvh]

So, I think 'raw HTML' is useful when it is only accidentally HTML.
And that one can most certainly happen in titles

[heathdutton]

Good edge case to think about! I tested this and the fix handles it correctly:

## <a href="link">Click</a> and <b>Bold</b>

ToC shows: Click and Bold

The HTML tags get stripped but the text content inside them is preserved - which is exactly what we want for a readable ToC.

I've added test cases covering this scenario. Also verified that code spans like \`` are handled separately by the markdown parser and aren't affected.

[wxiaoguang]

I fixed the tests, it needs to clearly assert what we want.

And we can see that the result doesn't seem good.

By the way: no need to rebase or force push, see the contribution guideline https://github.com/go-gitea/gitea/blob/main/CONTRIBUTING.md#maintaining-open-prs

[heathdutton]

Roger that, I'll step back.