[Security] XSS in urlize filter via unescaped URL in href attribute

Summary

The urlize filter in nunjucks/src/filters.js:593 injects URLs into <a href=""> via string interpolation without HTML-escaping, allowing attribute breakout and event handler injection when used with | safe or autoescape: false.

Suggested Fix

HTML-escape the URL before inserting into the href attribute.