Upgrade Mermaid to 11.17.2 (fixes six advisories in 11.12.x) #15042

quarto-cli vendors Mermaid 11.12.0 in src/resources/formats/html/mermaid/. Every rendered HTML page that uses Mermaid ships it. Six advisories affect all 11.12.x releases, and they're fixed in 11.14.1 or 11.16.1:

• GHSA-c4c3-pg64-4m4v
• GHSA-6x64-9x62-f2gx
• GHSA-87f9-hvmw-gh4p
• GHSA-xcj9-5m2h-648r
• GHSA-ghcm-xqfw-q4vr
• GHSA-6m6c-36f7-fhxh

They cover config prototype pollution, CSS/classDef and HTML injection, and an infinite loop in Gantt charts. 11.17.2 has none of them.

Proposal: bump to 11.17.2. That would match the VS Code extension, which moved its notebook renderer and its diagram preview to 11.17.2 in quarto-dev/quarto#1189. Both now run ahead of the CLI's Mermaid version.

As in dev-docs/upgrade-dependencies.md, get dist/mermaid.js and dist/mermaid.min.js from https://unpkg.com/mermaid@11.17.2/ and copy them into src/resources/formats/html/mermaid/.

Things to know about 11.13 to 11.17:

• These releases mostly add syntax (new diagram types and shapes, extra directives), so existing diagrams should keep working.
• One visible change: in 11.17, classDiagram and C4 diagrams moved to Mermaid's unified (v2) renderer, so they'll look somewhat different.
• 11.17 builds no longer embed name:"mermaid",version:"…" in the bundle. Anything that sniffs the version from the file needs another pattern; the extension's test now matches the renderer.draw(…, "X.Y.Z" literal.
• mermaid.min.js grows from 2.75 MB to 3.57 MB.