Fixed command parsing to use raw_body and added default HTML escaping to outbound chat messages.

I got bamboozled. The command system was originally built on the `body` field in Owncast's webhook payloads which contains rendered HTML rather than raw user input like I expected. Switching to `rawBody` makes more sense in my opinion, but doing so introduces a new risk: modules like custom commands can echo user input back to chat via placeholders like `$(1)` and, as it turns out, Owncast does not sanitize messages from integrations the way it does for regular users. This means unsanitized HTML could be injected into chat through the bot if the body was blindly swapped for the raw body.

All OwncastClient send methods now HTML-escape outgoing message bodies by default using markupsafe, with an `unsanitized=True` keyword-only opt-out for modules that intentionally need to send raw HTML.

owlbot/registries/commands.py

@@ -421,7 +421,7 @@ class CommandDispatcher:
 
         :param event: The chat event to check for commands.
         """
-        parsed = self._command_registry.parse(event.body)
+        parsed = self._command_registry.parse(event.raw_body)
 
         if parsed is None:
             return