Bump ViewComponent to v3.9.0

[benilovj]

This addresses an XSS vector ViewComponent/view_component#1950

[netlify]

✅ Deploy Preview for govuk-components ready!

Name	Link
🔨 Latest commit	eef1e42
🔍 Latest deploy log	https://app.netlify.com/sites/govuk-components/deploys/6597efb938b6b20008aca1eb
😎 Deploy Preview	https://deploy-preview-492--govuk-components.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify site configuration.

[benilovj]

@peteryates

This is in response to GHSA-wf2x-8w6j-qw37

My commit includes hacks to get the specs to pass to potentially save you some time, but I'm not sure it's the right way to actually fix the underlying breakages. Happy to take your steer or if to close the PR if you want to do it yourself.

[benilovj]

I'm also seeing warnings in the RSpec run:

.........................................................................................................................................................................................................................................................................................................................................................................................................................................WARNING: The GovukComponent::TabComponent::Tab component rendered HTML-unsafe output. The output will be automatically escaped, but you may want to investigate.
WARNING: The GovukComponent::TabComponent::Tab component rendered HTML-unsafe output. The output will be automatically escaped, but you may want to investigate.
WARNING: The GovukComponent::TabComponent::Tab component rendered HTML-unsafe output. The output will be automatically escaped, but you may want to investigate.
...................................................................................................................................................................................................................................................................................................................................

I dunno if they've been introduced by this bump?

[peteryates]

They have, just tracking them down now.

[peteryates]

Those warnings can be fixed with:

diff --git a/app/components/govuk_component/tab_component.rb b/app/components/govuk_component/tab_component.rb
index 1ac03dd..8dc2250 100644
--- a/app/components/govuk_component/tab_component.rb
+++ b/app/components/govuk_component/tab_component.rb
@@ -23,7 +23,7 @@ private

     def initialize(label:, text: nil, classes: [], html_attributes: {})
       @label = label
-      @text  = text
+      @text  = h(text)

       super(classes: classes, html_attributes: html_attributes)
     end

Happy with the changes, once the above is in I'll get it merged and a release ready 🙂 Thanks @benilovj