CVE-2026-15308: fix quadratic complexity in HTMLParser incremental
parsing; an unterminated markup construct fed across many feed() calls
no longer causes the growing buffer to be rescanned and reconcatenated
on every call (CPU denial of service). Adds a regression test.