Fix/markdown inline code entities

[BenLocal]

Summary

Fix commit-message Markdown rendering so characters escaped by Marked are displayed normally instead of exposing HTML entities such as < and ".

Examples:

• `<if test="onlyHasVideo==true">` now displays literally.
• getEnumByCode("250") no longer displays as getEnumByCode("250").

Root Cause

Git Graph+ uses marked.lexer() and renders the resulting token tree directly with Svelte.

Marked escapes token text for insertion into its own HTML renderer. Because Git Graph+ renders those escaped values as Svelte text nodes instead, the encoded strings were
displayed verbatim.

Changes

• Decode exactly one Marked escaping pass for display-only token fields:
  • inline code
  • plain text
  • escaped characters
  • image labels
• Keep decoded values inside Svelte text nodes so tag-looking content remains inert.
• Leave link/image URLs, raw token payloads, and raw HTML handling unchanged.
• Add Markdown and CommitDetails DOM regression coverage for:
  • inline XML-like code
  • quoted method arguments
  • single-pass entity decoding
  • escaped markup
  • link and image labels
  • prevention of unintended DOM element creation

Type of Change

• Bug fix
• Test addition or update
• New feature
• Refactoring
• Documentation update

Testing

• Full test suite: 1882 passed, 9 skipped
• Statement coverage: 97.98%
• Branch coverage: 90.39%
• npm run lint
• cd webview-ui && npm run check
• npm run build
• Root and webview production dependency audits: 0 vulnerabilities
• VSIX packaged and installed into VS Code Server
• Installed webview bundle matched the tested build by SHA-256

Security

The change does not introduce raw HTML rendering. It does not use innerHTML or Svelte {@html}.

URL fields are not decoded and continue to use the existing HTTP(S)-only validation.