GHSA-xhq9-whgq-49j5: Vendure has stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions

Vendure's Admin Dashboard has a stored XSS (cross-site scripting, where malicious code runs in a user's browser) vulnerability in how it displays product descriptions. The code tries to remove HTML by setting a description to an element's `innerHTML` and reading back the text, but this still executes harmful code like `<img src=x onerror=...>` that runs when parsed. A lower-privilege admin can inject this payload into a product description, and when a higher-privilege admin views the product list, the malicious code runs in their browser session, allowing account takeover.