[BUGFIX] Transform internal URIs in backend user interface

This change allows using internal URIs (like t3://) in components
of the backend user interface like

* system news show below the backend login form
* rich text details of system reports

HTML sanitization is applied to mentioned components as well.

Resolves: #95179
Related: #67556
Releases: master
Change-Id: I94c91fbb27380b26b136eba604e5c1552061eab2
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/71020


Tested-by: Oliver Bartsch <bo@cedev.de>
Tested-by: core-ci <typo3@b13.com>
Tested-by: Wouter Wolters <typo3@wouterwolters.nl>
Tested-by: Oliver Hader <oliver.hader@typo3.org>
Reviewed-by: Oliver Bartsch <bo@cedev.de>
Reviewed-by: Wouter Wolters <typo3@wouterwolters.nl>
Reviewed-by: Oliver Hader <oliver.hader@typo3.org>

typo3/sysext/backend/Resources/Private/Partials/LoginNews.html

@@ -36,7 +36,7 @@
 
 <f:section name="Item">
     <p id="loginNewsItem-{item.uid}" class="typo3-login-news-heading">{item.header}</p>
-    <f:format.html>{item.content}</f:format.html>
+    {item.content -> f:transform.html() -> f:sanitize.html()}
     <f:if condition="{item.date}"><p class="text-muted"><span class="sr-only"><f:translate key="login.news.date"/></span>{item.date}</p></f:if>
 </f:section>
 </html>

typo3/sysext/reports/Resources/Private/Templates/Report/Detail.html

@@ -8,7 +8,7 @@
             {error}
         </f:then>
         <f:else>
-            <f:format.html parseFuncTSPath="">{content -> f:format.raw()}</f:format.html>
+            {content -> f:transform.html() -> f:sanitize.html()}
         </f:else>
     </f:if>
 </f:section>