dep: update rails-html-sanitizer, loofah, and nokogiri (#421)

loofah 2.25.2 let a live CSS `url()` through `style` attributes, and
its HTML5 output could become new markup when a browser parsed it again.

Update rails-html-sanitizer to 1.7.2, loofah to 2.25.3, and nokogiri
to 1.19.5.

ref: https://github.com/rails/rails-html-sanitizer/releases/tag/v1.7.2
ref: https://github.com/flavorjones/loofah/releases/tag/v2.25.3
ref: https://github.com/sparklemotion/nokogiri/releases/tag/v1.19.5

Gemfile.lock

@@ -218,9 +218,9 @@ GEM
       rails (>= 8.0.2)
     lint_roller (1.1.0)
     logger (1.7.0)
-    loofah (2.25.2)
+    loofah (2.25.3)
       crass (~> 1.0.2)
-      nokogiri (>= 1.12.0)
+      nokogiri (>= 1.19.5)
     mail (2.9.1)
       logger
       mini_mime (>= 0.1.1)
@@ -251,13 +251,13 @@ GEM
     net-smtp (0.5.2)
       net-protocol
     nio4r (2.7.5)
-    nokogiri (1.19.4-aarch64-linux-gnu)
+    nokogiri (1.19.5-aarch64-linux-gnu)
       racc (~> 1.4)
-    nokogiri (1.19.4-arm64-darwin)
+    nokogiri (1.19.5-arm64-darwin)
       racc (~> 1.4)
-    nokogiri (1.19.4-x86_64-darwin)
+    nokogiri (1.19.5-x86_64-darwin)
       racc (~> 1.4)
-    nokogiri (1.19.4-x86_64-linux-gnu)
+    nokogiri (1.19.5-x86_64-linux-gnu)
       racc (~> 1.4)
     openssl (4.0.2)
     ostruct (0.6.3)
@@ -296,8 +296,8 @@ GEM
       activesupport (>= 5.0.0)
       minitest
       nokogiri (>= 1.6)
-    rails-html-sanitizer (1.7.1)
-      loofah (~> 2.25, >= 2.25.2)
+    rails-html-sanitizer (1.7.2)
+      loofah (~> 2.25, >= 2.25.3)
       nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0)
     rails_autolink (1.1.8)
       actionview (> 3.1)