Upgrade Sourcemeta dependencies

[jviotti]

Signed-off-by: Juan Cruz Viotti jv@jviotti.com

[cubic-dev-ai]

No issues found across 197 files

_{Re-trigger cubic}

[augmentcode]

🤖 Augment PR Summary

Summary: This PR upgrades the vendored Sourcemeta Core and Blaze dependencies.

Changes:

• Updates the root dependency pins for Core and Blaze, and aligns Blaze's nested Core manifest.
• Adds CMake package discovery for a Core installation shipped alongside Blaze.
• Refreshes Blaze canonicalization and Draft 3 compiler behavior for assertions and unrestricted types.
• Adds cycle protection to unevaluated-keyword dependency discovery.
• Extends schema conversion across 2019-09 and 2020-12, including vocabulary synthesis and anchor handling.
• Updates Core JSON Schema framing, formatting, URI escaping, UTF-8 validation, DNS, and email utilities.
• Replaces the vendored cmark-gfm implementation with Core's in-tree Markdown parser and renderer.
• Introduces Core's in-tree benchmark framework and removes the vendored Google Benchmark source tree.
• Reworks Core HTML escaping, buffering, and writer internals used by the new Markdown renderer.

Technical Notes: The bulk of the change is an upstream dependency snapshot; it also removes large third-party source trees now superseded by native Core components.

_{🤖 Was this summary useful? React with 👍 or 👎}

[augmentcode]

Review completed. 1 suggestion posted.

Comment augment review to trigger a new review at any time.

[augmentcode]

HTMLBuffer starts with both begin_ and cursor_ null, so this pointer subtraction is undefined before its first allocation (and again after take()). grow() calls size() on the first append, while str() and write() can call it on an empty writer, so ordinary Markdown/HTML rendering invokes UB and fails under UBSan.

Severity: medium

_{🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.}