Administrator XSS via raw abuse report rendering

Stored XSS in Forem before commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c allows remote attackers to run script via abuse reports. The public FeedbackMessagesController accepted attacker-controlled feedback_message[message] and previously permitted offender_id, and app/views/admin/feedback_messages/_feedback_message.html.erb rendered the stored message with raw(feedback_message.message) when offender_id was present. No authentication was required to submit the report, but exploitation required an administrator to view it; script execution was limited to the victim browser session and could read in-page data, abuse CSRF tokens, or perform administrative actions.