fix: end an HTML comment on the closing string

[RobinDev]

HtmlCommentRule::parse() ends the comment with consumeUntil('-->'), but consumeUntil() takes a set of characters (it is strcspn), not a string. So the comment ends at the first -, > or < in its body, and whatever follows is parsed as Markdown:

<!--start-show-more-->

main	<!--start-<p>show-more--></p>
this PR	<!--start-show-more-->

<!-- a - b --> breaks the same way. A comment whose body happens to contain none of those three characters — <!-- comment -->, the case the tests cover — works, which is why this went unnoticed.

Parser::consumeUntilString() already exists for exactly this, and it consumes to the end of the input when the needle is absent, so an unterminated comment stays literal instead of swallowing the rest as Markdown.

Tests cover a body holding -, > and <, and an unterminated comment. Checked against league/commonmark, which keeps all of them intact.

[github-actions]

Benchmark Results

Comparison of fix/html-comment-body against main (b4cd28e8892eb3049af2bc67612f34149ada5aa7).

Open to see the benchmark results

No benchmark changes above ±5%.

_{Generated by phpbench against commit 9dd0642}