x/net/html: text nodes outside of the HTML namespace improperly rendered

[rolandshoemaker]

Text nodes not in the HTML namespace were being incorrectly literally rendered, causing text which should've been escaped to not be. This could lead to an XSS attack.

This is a PRIVATE issue for CVE-2023-3978, tracked in http://b/289177674 and fixed by http://tg/1942896.

/cc @golang/security and @golang/release

[gopherbot]

Change https://go.dev/cl/514896 mentions this issue: html: only render content literally in the HTML namespace