GeezerVison

Bumps `github.com/gomarkdown/markdown` from
`v0.0.0-20260411013819-759bbc3e3207` to
`v0.0.0-20260724235538-61af6e1e6971`, the first version with the fix for
[GHSA-cv23-7vc5-jfh7](GHSA-cv23-7vc5-jfh7)
/ CVE-2026-102941. `IsSafeURL` sliced the URL before checking its
length, so empty or 1 to 2 byte link destinations panic when `Safelink`
is on.

The IronBank VAT scan of `coder-service-2:2.38.3` flags this (High) in
`/opt/coder`. It's justified as Mitigated today because the `safeURL`
wrapper and panic recovery in `coderd/render/markdown.go` (#28340) keep
it from crashing. The finding stays open until the library is bumped.
The 2.38 backport is #31442.

This pins the first fixed version, not upstream HEAD, to keep the change
small. Upstream has since added CommonMark parser changes and another
fix (79e163b, GHSA-c9jw-c68c-f39j, quadratic parse time on unclosed HTML
block tags) that isn't in a published advisory yet. That can be a
follow-up bump. The `safeURL` workaround is left as is; it can be
simplified separately.

Verified: `go test ./coderd/render/...` and `go test
./coderd/notifications/ -run Golden` pass. `go mod tidy` changed no
other modules. Local git hooks were skipped; CI is the gate.

Part of [ENT-229](https://linear.app/codercom/issue/ENT-229) (parent
[ENT-230](https://linear.app/codercom/issue/ENT-230)). 2.38 backport:
#31442.

Opened by Superblink on behalf of @droopy4096.

Co-authored-by: coder[bot] <137810501+coder[bot]@users.noreply.github.com>