Updated test and moved from remarkHtml to rehype

[mgc1194]

Story

DependaBot marked a few dependencies in this repo as high or critical.

This PR does:

• Updates the node version to 18.16.0
• Upgrades dependencies: remark-parse and unified.
• Removes dependencies: remark-html
• Adds the following dependencies: rehype-raw, rehype-sanitize, rehype-stringify and remark-rehype. (Note that more recent versions of the unified ecosystem are only ESM compatible)
• Renames imported libraries to match the naming pattern used in our main repo.
• Refactores the method markdownToHtml and markdownToSyntaxTree using rehype libraries instead of remark-html as we do in our main repo.
• Updates tests removing a \n introduced by remak-html (We no longer use remark-html)
• Deprecates codestudio plugin as code studio pull-through was deprecated along with Curriculum Builder.

After the update only two high-severity dependencies are left:

# npm audit report

trim  <0.0.3
Severity: high
Regular Expression Denial of Service in trim - https://github.com/advisories/GHSA-w5p7-h5w8-2hfq
fix available via `npm audit fix --force`
Will install [email protected], which is a breaking change
node_modules/trim
  remark-parse  <=8.0.3
  Depends on vulnerable versions of trim
  node_modules/remark-parse

2 high severity vulnerabilities

However we don't use this library on our server side, therefore this vulnerability can't be exploited.

[stephenliang]

It would be helpful to add a comment as to why we use this particular chain and that order matters (as we struggled a lot with this!)

[mgc1194]

Sounds good. I found out how we manage the schema in our main repo and copied the same pattern.

[stephenliang]

Should we also bump the version, perhaps to a new major since we're making significant updates to the underlying transitives? 2.0?

[mgc1194]

I am not opposed to that at all.

[stephenliang]

Curious why this was moved to dependencies as I see its only usage in test/utils.js

[mgc1194]

I am not 100% sure of the difference between dependencies and devDependencies, but having rehype-sanitize in dependencies also includes the hast-util-sanitize dependency in our node-modules. I was reading this discussion

[stephenliang]

devDependencies means that we won't bundle it in our tree (only used for development). For example, prettier is not needed for the usage of this package but it is useful for the development of this package (to make it look prettier).

In this case, do we need hast-util-sanitize somewhere in this package? We can probably just add that as a dependency rather than rehype-sanitize