Migrate templates to Zola 0.23 / Tera v2

bin/update-zola always installs the latest release, which as of
v0.23.0 rewrote the template engine to Tera v2. That broke the whole
site: removed filters (slice, concat, escape), test calls now require
named args, shortcodes are gone in favor of Tera components, and
content itself is now Tera-templated before markdown runs.

- slice(end=n) -> native [:n] slicing; concat(with=x) -> spread [...arr, x]
- escape -> escape_html; starting_with/containing -> named `pat` arg
- get_taxonomy_url `name` -> `term` (old name is deprecated)
- %+ date format no longer recognized; replaced with explicit RFC3339 pattern
- shortcodes (note/tip/warning/danger/youtube) rewritten as components;
  content call sites updated to component invocation syntax
- {% include %} no longer inherits for-loop-local variables (only ambient
  page/section context) - post-card.html converted to a component that
  takes page/index explicitly instead of relying on implicit `page`/`loop`
- two content code blocks with literal Jinja-style {{ }} syntax (Netlify
  CMS config, a Flask template snippet) wrapped in {% raw %} so Tera
  doesn't try to render them, since content is now templated too
- fixed a real content corruption bug along the way: the youtube
  shortcode's multi-line <iframe> tag had a conditional that could
  collapse to a whitespace-only line, which prematurely closed the
  HTML block under CommonMark rules and got the rest of the tag
  syntax-highlighted as code instead of rendered

Verified with a clean `zola build` and `zola serve` on v0.23.1, plus a
spot-check of the rendered HTML for both callouts and the video embed.
`zola check` only reports pre-existing external link rot, unrelated to
this change.

content/posts/scriptctf2025/index.md

@@ -41,6 +41,7 @@ upload.html
 display.html
 
 ```html
+{% raw %}
 <!DOCTYPE html>
 <html>
   <head>
@@ -60,6 +61,7 @@ display.html
     <p><a href="/">Upload another image</a></p>
   </body>
 </html>
+{% endraw %}
 ```
 
 `[app.py](http://app.py)`