Fix CodeQL comment tag filter finding

Patch is-unsafe's XML comment-close detector during builds so generated bundles recognize both HTML comment end forms and satisfy CodeQL until the dependency publishes a fix.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 277302b1-aa95-4012-817b-9752cdaee14e

dist/cleanup/index.js

@@ -60140,7 +60140,7 @@ const XML_PATTERNS = [
   {
     id: 'xml-comment-close',
     description: '--> closes an enclosing XML comment',
-    pattern: /-->/,
+    pattern: /--!?>/,
   },
   {
     id: 'xml-pi-close',

dist/setup/index.js

@@ -91195,7 +91195,7 @@ const XML_PATTERNS = [
   {
     id: 'xml-comment-close',
     description: '--> closes an enclosing XML comment',
-    pattern: /-->/,
+    pattern: /--!?>/,
   },
   {
     id: 'xml-pi-close',