mo has a XSS via inline SVG script tags in Markdown rendering

Summary

### Summary When rendering Markdown files containing inline SVG elements with `<script>` tags, the embedded JavaScript is executed in the browser. This is due to `rehype-raw` passing raw HTML (including SVG) through to the DOM without sanitization. ### PoC ```html <svg><script>alert(1)</script></svg> ``` Embedding the above in a Markdown file opened with mo causes the script to execute. ### Impact Arbitrary JavaScript execution in the context of the mo application when a user opens a malicious Markdown file. This could lead to data exfiltration of other opened Markdown file contents. ### Remediation Fixed by adding `rehype-sanitize` to the Markdown rendering pipeline, which strips dangerous elements such as `<script>` while preserving safe HTML.