Fix YAML frontmatter injection in event submission workflow

[HeyItsGilbert]

Summary

• Replaces hand-rolled f-string YAML serialization with yaml.safe_dump() — prevents frontmatter injection via unescaped " or newlines in issue body fields (title, location, URL, dates)
• Strips raw HTML tags from event descriptions before writing to markdown, blocking stored XSS through goldmark's unsafe renderer
• Fixes virtual field type: was written as the string 'true'/'false'; now serialized as a proper YAML boolean

Security context

Community event submissions are written from GitHub issue body content (untrusted input) into Hugo content files. The previous f-string interpolation allowed a crafted issue to break out of YAML string quoting and inject arbitrary frontmatter fields, or embed raw <script> tags in the rendered page.

Test plan

• Submit a test event issue with " in the event name and verify the generated .md frontmatter is correctly escaped
• Submit a test event issue with <script>alert(1)</script> in the description and verify it is stripped from the output file
• Verify a normal event submission still generates a valid content file and the PR renders correctly in Hugo

🤖 Generated with Claude Code