SEC-006: formaction or base sending forms elsewhere

Error: the page doesn't build until this is fixed.

A button's formaction and a base tag change where a form is sent. Pointed at another site, they send the form there with everything in it, including hidden fields like the CSRF token.

Fails

page(title: "Shoes", description: "All our running shoes, from light racers to trail shoes.") {
  h1 "Shoes"
  form("/newsletter", name: "newsletter") {
    field("email", type: Email, label: "Email")
    button "Subscribe"
    button(formaction: "https://mail.example.com/subscribe") "Subscribe with Example Mail"
  }
}

error[SEC-006]: `formaction` could send forms and their hidden fields to another site
 --> page.hypra:6:24
  |
6 |     button(formaction: "https://mail.example.com/subscribe") "Subscribe with Example Mail"
  |                        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  = help: use a fixed path on this site, or give the other address its own form
  = docs: https://hypralang.dev/rules/sec-006/

1 error, 0 warnings

Fixed

page(title: "Shoes", description: "All our running shoes, from light racers to trail shoes.") {
  h1 "Shoes"
  form("/newsletter", name: "newsletter") {
    field("email", type: Email, label: "Email")
    button "Subscribe"
  }
  form("https://mail.example.com/subscribe", name: "external") {
    field("email", type: Email, label: "Email")
    button "Subscribe with Example Mail"
  }
}

Another site gets its own form, which sends only what's in it.