forge-content: multi-platform content shortcode replacing github-content

[Arty2]

Why

forge-meta (PR #2) generalised the GitHub metadata block to multi-forge. The matching content-fetching shortcode (github-content.html) hadn't been migrated — it was still GitHub-only, and unlike its renderer-side cousin it had no HTML sanitisation. A README from a public repo could ship <script> / <iframe> / onerror= straight into the consumer site's published HTML because Goldmark's unsafe = true (configured for inline-HTML support in shortcodes) passes raw HTML through.

This PR replaces it with a multi-platform shortcode and adds two new security layers on top of the existing shortcode-delimiter neutralisation.

What

Shared resolver. New layouts/partials/forge-resolve.html owns parsing of Forge / legacy Github values, host detection, platform auto-detection (github.com / gitlab.com / codeberg.org / params.forgeContent.gitlabHosts), and label resolution. Returns a dict via return. forge-meta.html is refactored to call it; the new shortcode calls it the same way. The two templates can no longer drift on detection logic.

{{< forge-content >}} (new shortcode) accepts:

param	default	effect
repository	—	host/owner/repo (unified) or owner/repo (legacy GitHub).
branch	master	Git ref.
path	(empty)	File path. Empty: GitHub uses /readme endpoint; GitLab + Forgejo probe README.md, README, readme.md in order.
platform	auto-detect	Override (github / gitlab / forgejo).
unsafe	false	Allow <svg> / <math> from trusted sources.

Three-layer security before markdownify:

1. Shortcode delimiter neutralisation (carried forward verbatim from the legacy shortcode). {{<, {{%, >}}, %}} replaced with full-width lookalikes — prevents server-side template injection.
2. HTML tag denylist (new). A single replaceRE entity-escapes opening + closing forms of: script style iframe frame frameset noframes object embed applet form input button textarea select option optgroup fieldset legend link meta base noscript, plus svg / math unless unsafe="true". Disallowed tags render as visible escaped text — they cannot execute.
3. Dangerous attribute strip (new). Event handlers (on*=...), javascript: URIs in href / src / xlink:href, and IE-era style="...expression(..." are stripped wherever they appear; the containing tag survives but loses the attack vector.

This is a denylist, not a strict GFM allowlist — sufficient for typical READMEs, conservative on dangerous primitives. Documented in the README's new "Forge content" section.

Hard break (per user direction). github-content.html is deleted rather than wrapped. Sites using {{< github-content >}} must rename to {{< forge-content >}} and prefix the host (e.g. repository="github.com/owner/repo"). Migration is one find-and-replace.

Other changes:

• i18n/{en,el}.yaml: github-error → forge-error (no GitHub-specific text).
• README.md: new "Forge content" section; shortcode list updated.
• exampleSite/content/posts/github-demo/index.md: migrated as the live smoke test.

Test plan

• cd exampleSite && hugo --gc clean; no DEPRECATION warnings; demo post renders.
• When the API fetch fails (sandbox 403), shortcode emits the forge-error fallback link instead of erroring out.
• Refactored forge-meta.html is byte-equivalent to master on pages with Forge: front-matter (same code path, just extracted).
• CI verification — once GitHub Actions runs in a network-enabled environment, the demo post fetches the upstream README; inspect rendered HTML to confirm:
  • shortcode delimiters in fetched content (if any) appear as full-width characters
  • any <script> / <iframe> / <form> etc. in the README appear as <script> etc.
  • any onerror= / javascript: URIs are absent from the rendered output
• Manual: try a GitLab repo (repository="gitlab.com/group/project") and a Codeberg repo to exercise the probe.
• Migrate any downstream sites that used {{< github-content >}} (rename + add host prefix).

Independent of PR #5 (polish-pass) and PR #6 (print-stylesheet) — branches off master.

---

Generated by Claude Code