Fix highlight.js XSS / unescaped HTML issue

[mmattel]

Fixes: #437 (Escape the HTML within code blocks)
References: #435 (Fix and improve highlighting with highlight.js)

When package.json was defined in the initial setup, highlight.js was not limited to the major version 9.

When the time passed by, highlight.js published two major release with twice a lot of backend changes which were incompatible with Antora. The crucial upgrade from v9 to v10 was made on 20 Dec 2020 with PR: ([Security] Bump highlight.js from 9.18.1 to 10.4.1). As there was no upgrade limitation set in package.json, CI reported a go and no other obstacles were known at the time of reading, the PR got merged.

Note that it is a good advice to regulary check the Antora Default UI for changes...

Funnily nobody identified the XSS / unescaped HTML issue which was printed in the browsers console...

With a discussion in the Antora channel Escape content in source block, it turned out which issue we have and that we have to revert to highlight.js v9 AND avoid any upgrade for the time being.

This PR:

• Fixes the XSS issue by going back and fixing the version of highlight.js to v9.18.3 (supported by Antora)
• Updates the pattern match regex for bash to be up-to-date with the upcoming v11 release
• Adds and updates the keywords of bash to a more close version of v11

Note that the comments written are intentionally to avoid an accidentially update of highlight.js.

@jnweiger fyi (as discussed)

[xoxys]

Please let discuss this tomorrow... Sorry, but switching back to an unmaintained 2 years old version is a no-go.

[xoxys]

Needs discussion

[mmattel]

Yes, let us discuss this tomorrow. I am not amused too...

[mmattel]

Summary of the discusson with @xoxys

We will close this PR and do not merge it.

• The unescaped HTML report is present in all three highlight.js major versions (9, 10, 11) but it is not a highlight.js issue. Antora must sanitize/escape HTML properly before handing over data to highlight.js
• Version 11 of highlight.js added a warning (+ a disable warning capability) if it finds unescaped HTML in a code block. Note that we use this disable warning capability with Fix and improve highlighting with highlight.js #435 - this is the reason why it came up by looking into the browser console.
• It mostly affects '<', '>', and '&' in code examples like when using admin@<your-nas-IP> or <?php
• Using an online XSS Scanner report(Light) tool did not report an XSS issue on an example page QNAP where unescaped HTML issues were reported
• We do not have any user input except search where code can get injected. This means the security warning tells that there is an issue and it should be fixed on the Antora side, but it has minimal effect to us atm
• It makes no sense to keep an 2 year old, outdated and unsupported release of highlight.js
• With one known drawback. It is not only about highlighting example code, but there are other functionalities bound to highlighting which do not work correctly, see Upgrading highlight.js. CallOuts which are affected are currently not used in our documentation - therefore currently not an issue for us.
• Implementing another highlighter like prism would be a lot of work, is time consuming and a resource blocker