RSS feed widget renders unvalidated entry.link scheme, enabling javascript: DOM-XSS

### NetBox Edition NetBox Community ### NetBox Version v4.6.5 ### Python Version 3.14 ### Steps to Reproduce 1. Host an RSS/Atom feed you control (e.g. https://attacker.example/feed.xml) containing at least one entry whose <link> uses a javascript: scheme: <item> <title>Click me</title> <link>javascript:alert(document.cookie)</link> <description>Latest news</description> </item> 2. Go to your dashboard and click Add Widget. 3. Choose RSS Feed as the widget type. 4. Set Feed URL to https://attacker.example/feed.xml and save the widget. 6. Observe the entry rendered ### Expected Behavior Feed entry links should be validated against ALLOWED_URL_SCHEMES before rendering (as CustomLink already does). Any link with a disallowed scheme (e.g. javascript:, data:) should be blanked so it cannot execute script, while legitimate http/https links continue to render normally. ### Observed Behavior The RSS feed widget interpolates the feed-controlled entry.link directly into <a href="{{ entry.link }}"> with no scheme validation.