Update pulldown_cmark dep to v0.10, and add pulldown_cmark_escape dep.

[timonvo]

The pulldown_cmark escaping functionality is now shipped in a separate
pulldown_cmark_escape crate
(https://crates.io/crates/pulldown-cmark-escape), starting with v0.10.0.

The markdown.rs module has to be adapted to a few API changes in
pulldown_cmark, and we have to introduce explicit handling of alt
text to ensure it continues to be properly escaped.

There are also a few other behavior changes that are caught by the
tests, but these actually seem to be desired, so I've updated the insta
snapshot files for those tests to incorporate those changes.

Sanity check:

• Have you checked to ensure there aren't other open Pull Requests for the same update/change?
  Yes, but see the related GitHub-Style Footnotes #2326 (comment).

Code changes

(Delete or ignore this section for documentation changes)

• Are you doing the PR on the next branch?

If the change is a new feature or adding to/changing an existing one:

• Have you created/updated the relevant documentation page(s)?
  --> N/A

[Keats]

can you add a comment for what this is? No need for the type as well

[timonvo]

Ah yes, good call. I've actually renamed the variable to inside_attribute as well, to be a little more descriptive.

[Keats]

how come it's not escaping anymore here?

[timonvo]

I believe this is due to a behavior change in pulldown-cmark, rather than the changes I made in this pull request. I think it might be pulldown-cmark/pulldown-cmark#830, specifically. It introduces a new escape_html_body_text which should be used for escaping text nodes and which only escapes '<', '>', and '&', as opposed to escape_html which should be used for escaping HTML attributes and which escapes single and double quotes as well.

I believe that pulldown-cmark's push_html will now convert Event::Text nodes to HTML using escape_html_body_text (see src/html.rs in that pull request), hence why we see these quotes not being escaped anymore. This is also why we need to handle the alt attribute's text manually now, to ensure it gets attribute-escaped rather than body-escaped (which is now the default).

And FWIW, all other existing uses of escape_html that I could find in Zola were for escaping HTML attributes, so I think none of them need to be switched to escape_html_body_text.

[Keats]

so it was inserting the header in the footnote?

[timonvo]

Yeah, seems like it. pulldown-cmark 0.10 contains a bunch of footnotes-related fixes, which I'm guessing are responble for this change. Since the new version seems to be correct and the old version seemed wrong, I didn't investigate further to figure out exactly which commit fixed this.

[timonvo]

Thanks for the review, I think this is ready for another round. Note that I also added a note to the CHANGELOG.md file to draw attention to the minor behavior changes people may see after this change.

[Keats]

Thanks!