GHSA-h58c-xccx-75m3: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings

The ApplicationName and LogoURL appearance settings were rendered into HTML output without sufficient escaping which let a highly privileged Owner-role user inject HTML into the Coder dashboard and SMTP notification emails.

Note: Exploitation requires the Owner role which already holds full administrative control of the deployment so practical impact is limited.