fix: stop dompurify from breaking draw.io diagrams (#7888)

Newer versions of dompurify strip <foreignobject> tags if not explicitly
allowed. See https://github.com/cure53/DOMPurify/issues/1040

Fixes #7744

server/modules/rendering/html-security/renderer.js

@@ -34,7 +34,8 @@ module.exports = {
 
       input = DOMPurify.sanitize(input, {
         ADD_ATTR: allowedAttrs,
-        ADD_TAGS: allowedTags
+        ADD_TAGS: allowedTags,
+        HTML_INTEGRATION_POINTS: { foreignobject: true }
       })
     }
     return input