[shepilov]

Fixes #5130

Problem

prosemirror-go does not fully validate the steps sent by clients. A replaceAround step whose insert is outside its slice (e.g. insert: -1 with openStart: 1) panics with an index out of range in model.replace, so PATCH /notes/:id answers with a 500. Any client that can edit a note can send it, including the recipient of a shared note.

Solution

apply now calls each step through applyStep, which turns a panic into a failed step. The client gets ErrCannotApply (409) and the note is not modified, as for any step that cannot be applied. The notes lock is still released by its defer.

Validating the steps in prosemirror-go itself would be a larger change in another repository; the recover also guards against the other unchecked indexes of the library. StepFromJSON was probed with malformed steps (wrong types, missing fields, unknown step types): it returns errors and does not panic, so it is left as is.

The Markdown import panic of the same fuzzing campaign (#5129) is fixed by #5152; this PR does not conflict with it.

Test plan

• TestApplyStepThatPanicsInProsemirror: the step from Notes: PATCH /notes/:id with a replaceAround step whose insert is out of the slice panics in prosemirror-go (index out of range, 500) #5130 returns ErrCannotApply and the version is unchanged (panics with index out of range [9] with length 9 without the fix)
• go test ./model/note/ passes, alone and merged with fix(note): return an error for table markers outside a table #5152