fix: escape reserved XML prompt tags in sanitizeContent

[Juwan-Hwang]

Summary

This PR enhances prompt boundary formatting and robustness by escaping reserved XML prompt delimiter tags (such as </pr_or_issue_body>, </trigger_comment>, <context>, etc.) in user-supplied content within sanitizeContent.

Problem & Motivation

claude-code-action relies on XML-style tags to delimit external untrusted content (PR bodies, issue comments, reviews) within the prompt constructed for Claude.

When external content contains raw XML closing or opening tags that match reserved prompt structure delimiters (either inadvertently in discussions/code snippets or deliberately), it can prematurely close container tags and disrupt the prompt's intended context boundary and structure.

Changes

1. Added escapePromptTags in src/github/utils/sanitizer.ts:
   • Matches opening, closing, and self-closing tags corresponding to reserved prompt delimiters (formatted_context, pr_or_issue_body, trigger_comment, custom_instructions, context, metadata, etc.).
   • Converts < and > to < and > for those specific reserved tags while preserving non-reserved HTML tags and hyphenated custom identifiers (e.g., <div class="...">, <context-sensitive>).
   • Runs after normalizeHtmlEntities to ensure entity-encoded variations (e.g. </trigger_comment>) are safely neutralized.
2. Added comprehensive unit tests in test/sanitizer.test.ts:
   • Tests opening, closing, and self-closing reserved tags.
   • Tests tags with attributes, trailing whitespace, and mixed case.
   • Tests preservation of legitimate HTML elements and non-reserved identifiers.
   • Tests integration with sanitizeContent.

Verification

• Added test coverage in test/sanitizer.test.ts verifying all patterns and edge cases.
• Formatted with Prettier.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Juwan-Hwang]

Rebased onto main and resolved merge conflicts in test/sanitizer.test.ts. Ready for re-approval and merge!