[PM-37648] Fix double HTML encoding in emergency access emails

[singhvishalkr]

Fixes #4845

When sending emergency access emails, names with special characters like German umlauts appear as HTML entities (e.g., Stephan Windmüller instead of Stephan Windmüller).

The root cause is double HTML encoding:

1. CoreHelpers.SanitizeForEmail(name) encodes the name (htmlEncode defaults to true)
2. Handlebars templates also escape values when rendering

Other email methods in the same file already pass false to avoid this (e.g., SendProviderInviteEmailAsync). This change applies the same pattern to all emergency access email methods:

• SendEmergencyAccessInviteEmailAsync
• SendEmergencyAccessConfirmedEmailAsync
• SendEmergencyAccessRecoveryInitiated
• SendEmergencyAccessRecoveryApproved
• SendEmergencyAccessRecoveryRejected
• SendEmergencyAccessRecoveryReminder
• SendEmergencyAccessRecoveryTimedOut

Tested by reviewing the code path and confirming the fix matches existing patterns.

[CLAassistant]

All committers have signed the CLA.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[bitwarden-bot]

Thank you for your contribution! We've added this to our internal tracking system for review.
ID: PM-37648
Link: https://bitwarden.atlassian.net/browse/PM-37648

Details on our contribution process can be found here: https://contributing.bitwarden.com/contributing/pull-requests/community-pr-process.

[addisonbeck]

SendEmergencyAccessConfirmedEmailAsync
SendEmergencyAccessRecoveryApproved
SendEmergencyAccessRecoveryReminder

It doesn't look like these are actually changed.

[addisonbeck]

see above

[singhvishalkr]

Current head now changes the three emergency-access mail paths the review called out (SendEmergencyAccessConfirmedEmailAsync, SendEmergencyAccessRecoveryApproved, and SendEmergencyAccessRecoveryReminder) and adds a regression test that checks the rendered HTML encodes the user-facing name exactly once.

[singhvishalkr]

Rebased onto current main and resolved the test-file conflict in 5554d6c16. The three emergency-access paths from the review are covered by the new single-encoding regression test, while the upstream cloud-region URL test remains intact.

Local checks here were limited to git diff --check and static review because this shell does not have dotnet installed.

[addisonbeck]

I'll get this passed over to QA. Once that passes, we'll get it merged. Thanks for the contribution!

[sonarqubecloud]

Quality Gate passed

Issues
6 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

❌ Patch coverage is 42.85714% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 61.53%. Comparing base (0fce684) to head (549ddd6).
⚠️ Report is 2 commits behind head on main.

Files with missing lines	Patch %	Lines
src/Core/Platform/Mail/HandlebarsMailService.cs	42.85%	4 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #7652      +/-   ##
==========================================
+ Coverage   61.49%   61.53%   +0.03%     
==========================================
  Files        2253     2253              
  Lines       99103    99103              
  Branches     8960     8960              
==========================================
+ Hits        60945    60984      +39     
+ Misses      36007    35968      -39     
  Partials     2151     2151              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[addisonbeck]

Thanks for contributing @singhvishalkr!