CVE-2026-32289: html/template - track JS template literal brace depth across
{{if}}/{{range}} branches and include it in context comparison and mangling,
so actions inside JS template literals are no longer escaped incorrectly,
which could lead to XSS