False positive: email content injection

**Description of the false positive**

A simple, valid e-mail address inside an e-mail message triggers https://codeql.github.com/codeql-query-help/go/go-email-injection/

The rule also triggers on valid html, although the [security model](https://pkg.go.dev/html/template#hdr-Security_Model) in `html/template` should make it safe.

**Code samples**
```go
func SendEmailHandler(w http.Response, r http.Request) {
user := r.URL.Query().Get("user")
if m, _ := regexp.MatchString("[a-z]{3}", user); !m {
return
}
msg := fmt.Sprintf("To: %s@example.com\r\n\r\nHello!", user)
smtp.SendMail("", nil, "", nil, []byte(msg))
}
```

Another example where `html/template` takes care of escaping the html content.

```go
var htmlTempl = template.Must(template.New("t").Parse("Message:

func SendEmailHandler(w http.Response, r http.Request) {
msg := r.URL.Query().Get("message")
buf := bytes.NewBuffer([]byte(`MIME-version: 1.0;\nContent-Type: text/html; charset=\"UTF-8\";\n\n`))
htmlTempl.Execute(buf, msg)
smtp.SendMail("", nil, "", nil, buf.Bytes())
}```

Start with the Go email-injection query documentation linked in the issue and compare its behavior against both supplied examples. Investigate how valid email content and html/template escaping are modeled; done means these safe cases no longer produce false positives while genuine injection cases remain detected.

由索引模型根據 Issue 內容生成。