refactor: markup render (#38864)

1. add missing CSP header to api & web render endpoints.
2. make jupyter render skip post-processors, nothing to process
3. make ShortLinkProcessor correctly validate URL schemes and respect
the CustomURLSchemes setting

modules/markup/html_link_test.go

@@ -0,0 +1,24 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package markup
+
+import (
+	"strings"
+	"testing"
+
+	"gitea.dev/modules/test"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestShortLinkProcessor(t *testing.T) {
+	test := func(input, expected string) {
+		sb := new(strings.Builder)
+		err := postProcess(NewTestRenderContext("/base"), []processor{shortLinkProcessor}, strings.NewReader(input), sb)
+		assert.NoError(t, err)
+		assert.Equal(t, test.NormalizeHTMLSpaces(expected), test.NormalizeHTMLSpaces(sb.String()))
+	}
+	test("[[name=foo|link=./link]]", `<a href="/base/link">foo</a>`)
+	test("[[name=foo|link=javascript:bar]]", `[[name=foo|link=javascript:bar]]`)
+}