fix(web): canonical mention attributes are preserved with custom sanitizationConfig

[hejsztynx]

Summary

When linkRegex in sanitizationConfig was provided, DOMPurify tested the attributes whitelisted with ADD_ATTR (in our case text and indicator) against the URI regex. Now the text and indicator values are not tested this way. Added relevant regression tests.

Test Plan

On the web example app, add a mention and look at the HTML output

Compatibility

OS	Implemented
iOS	❌
Android	❌
Web	✅

Checklist

• E2E tests are passing
• Required E2E tests have been added (if applicable)

[Copilot]

Pull request overview

This PR fixes a web sanitization edge case where providing a custom sanitizationConfig.linkRegex caused DOMPurify to incorrectly treat whitelisted <mention> attributes (text, indicator) as URI-bearing attributes, resulting in those attributes being stripped. It updates the sanitization configuration so those canonical mention attributes are preserved even when a custom URI allowlist regex is used, and adds a regression test.

Changes:

• Update DOMPurify configuration to treat mention’s canonical attributes as URI-safe when ALLOWED_URI_REGEXP is customized.
• Thread sanitization configuration through web HTML normalization via a getter to ensure the latest config is used at normalization time.
• Add a regression test covering mention attribute preservation with a custom linkRegex.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
src/web/useOnChangeHtml.ts	Switches from passing a static sanitization config to passing a getter into HTML normalization.
src/web/sanitization/htmlSanitizer.ts	Adds ADD_URI_SAFE_ATTR for mention canonical attributes to prevent URI-regex checks from stripping them.
src/web/normalization/tiptapHtmlNormalizer.ts	Updates normalization to call a sanitization-config getter before sanitizing.
src/web/EnrichedTextInput.tsx	Updates call sites to pass a sanitization-config getter into on-change normalization and imperative getHTML().
src/web/tests/sanitization.test.ts	Adds regression coverage to ensure <mention> attributes survive when a custom linkRegex is provided.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.