Add will-attach-webview, update mammoth, other security updates

[bengotow]

No description provided.

[indent-staging]

Important

Indent Zero has shut down and no longer reviews pull requests.
To get this pull request reviewed by Indent instead:

1. Sign up for Indent
2. Install Indent on your repositories
3. Turn on code review
4. Comment @indent on this pull request

Step 4 is only needed for pull requests that were already open when you switched. After that, Indent reviews new pull requests on its own.

To stop this notice, turn PR reviews off in Indent Zero.

[indent]

PR Summary

Batch of security hardening changes for the main renderer (which runs with nodeIntegration and webviewTag enabled), closing HTML-injection→RCE vectors and adding prototype-pollution defense for spawned processes. Each change preserves existing behavior for legitimate content, and the one privileged consumer (the onboarding sign-in <webview>) is unaffected since it reads its result via executeJavaScript and needs no Node/preload.

• will-attach-webview guard (mailspring-window.ts): forces every attached <webview> guest to safe preferences (no preload, nodeIntegration off, contextIsolation/sandbox on), regardless of tag attributes. Only MailspringWindow enables webviewTag, so coverage is complete.
• Thread-search escaping (tokenizing-contenteditable.tsx): HTML-escapes the search value before writing it via innerHTML, blocking markup injection from a crafted message Subject.
• Sanitizer ALLOW_DATA_ATTR: false (sanitize-transformer.ts): strips data-* (notably data-slate-fragment) from untrusted mail; verified no display/composer path reads data-* off sanitized content.
• Uneditable block re-sanitize (uneditable-plugins.tsx): sanitizes block HTML at the render boundary; idempotent with the existing deserialize-time sanitize.
• Null-prototype child-process env (mailsync-process.ts, database-store.ts, windows-updater.js): copies the environment onto a null-prototype object so a polluted Object.prototype can't inject env like NODE_OPTIONS/LD_PRELOAD. Same variable set as before.
• mammoth ^1.11.0 → ^1.12.3 (package.json/lock): fixes a DOCX prototype-pollution vulnerability.

Issues

No issues found.

CI Checks

All CI checks passed on 1c96677.

[indent-staging]

Important

Indent Zero has shut down and no longer reviews pull requests.
To get this pull request reviewed by Indent instead:

1. Sign up for Indent
2. Install Indent on your repositories
3. Turn on code review
4. Comment @indent on this pull request

Step 4 is only needed for pull requests that were already open when you switched. After that, Indent reviews new pull requests on its own.

To stop this notice, turn PR reviews off in Indent Zero.