v0.50.0-sec.4 fixes CVE-2026-27136 for Go 1.24.0

release-v0.50.0-sec.4
Upstream: https://go.dev/cl/781685

What's Changed

• [Go 1.24.0] CVE-2026-27136: html: ignore duplicate attributes during tokenization by @germanparente in #12

Full Changelog: v0.50.0-sec.3...v0.50.0-sec.4