vditor vulnerable to Cross-site Scripting

An attacker crafts a malicious HTML payload containing JavaScript event handlers (e.g., `onload`, `onerror`, `onmouseover`) or script tags. The victim must be tricked into copying this payload (e.g., from a malicious webpage or email) and pasting it into the Vditor editor using standard paste operations (Ctrl+V or right-click paste). Because the editor did not sanitize pasted HTML, the malicious script executes in the context of the victim's browser session, leading to cross-site scripting (XSS) [CWE-79]. No authentication or special network position is required beyond the victim visiting a page that embeds Vditor.

The vulnerability is in the `paste` function within `src/ts/util/fixBrowserBehavior.ts`. When pasting content, the editor retrieves `doc.body.innerHTML` from the pasted HTML but did not sanitize it before inserting it into the editor's DOM. The patch adds a call to `Lute.Sanitize(textHTML)` on the pasted HTML content before processing it further [patch_id=1706196].

The patch adds a single line in `src/ts/util/fixBrowserBehavior.ts` that calls `Lute.Sanitize(textHTML)` on the pasted HTML content before it is processed and inserted into the editor [patch_id=1706196]. The `Sanitize` method is also declared in the TypeScript type definitions (`types/index.d.ts`). This sanitization strips or escapes malicious HTML elements and attributes (such as script tags and event handlers), preventing the execution of attacker-controlled JavaScript when the pasted content is rendered in the editor.