) (#28644)

Backport of #28397

Original PR: #28397 — fix(coderd/notifications): HTML-escape the email
template values
Merge commit: 2236710
Requested by: @BobbyHo

Opened manually because the Backport workflow run for `release/2.35`
failed:
https://github.com/coder/coder/actions/runs/32985803559/job/98231735668

## Why the automatic backport failed

Two separate things went wrong in that run, and only one of them is
about conflicts.

The cherry-pick hit seven `modify/delete` conflicts (below). That alone
is not fatal — the same happened for `release/2.36` and `release/2.37`,
where the job still pushed a placeholder branch and opened a PR for
manual resolution.

What actually failed the job was the push:

```
! [remote rejected] backport/28397-to-2.35 -> backport/28397-to-2.35
  (Unable to determine if workflow can be created or updated due to timeout; `workflows` scope may be required.)
```

This cherry-pick touches no files under `.github/workflows/`, so this is
GitHub timing out while determining scope rather than a genuine
permission gap. The push was retried by hand for this PR and succeeded
unchanged. The net effect of the failure was that no branch and no PR
were created for 2.35 at all, so this one is opened from scratch rather
than fixed up in place.

## Manual resolution: 7 golden files dropped

`release/2.35` already carries #28611 (the 2.35 backport of #28340), so
the `notifier.go` hunk applies cleanly. What remains is a genuine
`modify/delete` conflict on seven golden files:

```
TemplateAIBudgetLimitReachedUser.html.golden
TemplateAIBudgetWarningUser.html.golden
TemplateUserAccountActivatedServiceAccount.html.golden
TemplateUserAccountCreatedServiceAccount.html.golden
TemplateUserAccountCreatedWithoutAccountType.html.golden
TemplateUserAccountDeletedServiceAccount.html.golden
TemplateUserAccountSuspendedServiceAccount.html.golden
```

These are fixtures for the AI budget and service-account notification
templates, both of which postdate the 2.35 branch point.
`coderd/notifications/` on `release/2.35` contains no reference to
`AIBudget`, `BudgetLimitReached`, `BudgetWarning`, `ServiceAccount` or
`AccountType`, so there is no template to render them and no test case
that reads them. **All seven were removed rather than added**; carrying
them over would leave orphan fixtures.

This is the only deviation from the original PR. Verified with a
diff-of-diffs: excluding those seven paths, this commit is
byte-identical to #28397. The escaping changes to `html.gotmpl`,
`notifier.go` and `smtp_internal_test.go` are fully intact.

Net: 32 files, +230/−75 (upstream: 39 files, +244/−89 — the delta is
exactly the seven goldens). The smtp golden directory holds 38 files
before and after, so nothing was added or lost.

## Verification

- `go vet ./coderd/notifications/...` — clean
- `go test ./coderd/notifications/dispatch/...` — pass, including the
three new `TestSMTPHTMLTemplateEscapes*` tests
- `go test ./coderd/notifications/ -run
TestNotificationTemplates_Golden` — pass across all affected goldens

## Related backports

- #28603 — `release/2.37`
- #28604 — `release/2.36`
- #28643 — `release/2.29` (still needs manual resolution)

) (#28646)

Backport of #28397

Original PR: #28397 — fix(coderd/notifications): HTML-escape the email
template values
Merge commit: 2236710
Requested by: @BobbyHo

Opened manually because the Backport workflow run for `release/2.34`
failed:
https://github.com/coder/coder/actions/runs/32985803559/job/98231735640

## Why the automatic backport failed

Two separate things went wrong in that run, and only one of them is
about conflicts.

The cherry-pick hit nine `modify/delete` conflicts (below). That alone
is not fatal — the same happened for `release/2.36` and `release/2.37`,
where the job still pushed a placeholder branch and opened a PR for
manual resolution.

What actually failed the job was the push:

```
! [remote rejected] backport/28397-to-2.34 -> backport/28397-to-2.34
  (Unable to determine if workflow can be created or updated due to timeout; `workflows` scope may be required.)
```

This cherry-pick touches no files under `.github/workflows/`, so this is
GitHub timing out while determining scope rather than a genuine
permission gap. The push was retried by hand for this PR and succeeded
unchanged. The net effect of the failure was that no branch and no PR
were created for 2.34 at all, so this one is opened from scratch rather
than fixed up in place. The `release/2.35` job (#28644) failed the same
way.

## Manual resolution: 9 golden files dropped

`release/2.34` already carries #28606 (the 2.34 backport of #28340), so
the `notifier.go` hunk applies cleanly. What remains is a genuine
`modify/delete` conflict on nine golden files:

```
TemplateAIBudgetLimitReachedUser.html.golden
TemplateAIBudgetWarningUser.html.golden
TemplateUserAccountActivatedServiceAccount.html.golden
TemplateUserAccountCreatedServiceAccount.html.golden
TemplateUserAccountCreatedWithoutAccountType.html.golden
TemplateUserAccountDeletedServiceAccount.html.golden
TemplateUserAccountSuspendedServiceAccount.html.golden
TemplateWorkspaceAutostopReminder.html.golden
TemplateWorkspaceDormant_NoAutoDelete.html.golden
```

These are fixtures for notification templates and test cases that
postdate the 2.34 branch point — AI budgets, service accounts, the
autostop reminder, and the no-auto-delete variant of the dormancy
notice. `coderd/notifications/` on `release/2.34` contains no reference
to `AIBudget`, `BudgetLimitReached`, `BudgetWarning`, `ServiceAccount`,
`AccountType`, `AutostopReminder` or `NoAutoDelete`, so there is no
template to render them and no test case that reads them. **All nine
were removed rather than added**; carrying them over would leave orphan
fixtures.

Note that `TemplateWorkspaceDormant.html.golden` does exist on 2.34 and
is updated normally by this PR. Only the `_NoAutoDelete` variant of that
test case is dropped.

This is the only deviation from the original PR. Verified with a
diff-of-diffs: excluding those nine paths, this commit matches #28397
line for line. The only textual differences are blob hashes and hunk
line offsets — `notifier.go` sits one line higher on this branch, so the
hunk header reads `@@ -252` instead of `@@ -253`. The escaping changes
to `html.gotmpl`, `notifier.go` and `smtp_internal_test.go` are fully
intact.

Net: 30 files, +226/−71 (upstream: 39 files, +244/−89 — the delta is
exactly the nine goldens). The smtp golden directory holds 36 files
before and after, so nothing was added or lost.

## Verification

- `go vet ./coderd/notifications/...` — clean
- `go test ./coderd/notifications/dispatch/...` — pass, including the
three new `TestSMTPHTMLTemplateEscapes*` tests
- `go test ./coderd/notifications/ -run
TestNotificationTemplates_Golden` — pass across all affected goldens

## Related backports

- #28603 — `release/2.37`
- #28604 — `release/2.36`
- #28644 — `release/2.35`
- #28643 — `release/2.29` (still needs manual resolution)