Trim change note to match repo conventions

Shortened to a single terse sentence, matching the depth/style of other
recent change-notes (one bullet, no implementation detail), and called
out the ASP.NET Core Razor Pages/MVC scope.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: felickz

csharp/ql/lib/change-notes/2026-09-18-razor-tag-helper-attribute-xss-fp.md

@@ -1,4 +1,4 @@
 ---
 category: majorAnalysis
 ---
-* The `cs/web/xss` query no longer flags `WriteLiteral` calls that the Razor source generator emits for the value of an HTML attribute on an element that also has a tag helper (for example, an attribute populated via `asp-for`). Such values are captured into a string buffer by matching `BeginWriteTagHelperAttribute`/`EndWriteTagHelperAttribute` calls and are HTML-attribute-encoded before being rendered, so they are not a real cross-site scripting sink. This fixes a false positive that could previously be reported for any tainted value bound to an HTML attribute on a tag-helper-enabled element.
+* Fixed a false positive in `cs/web/xss` for ASP.NET Core Razor Pages/MVC views: `WriteLiteral` calls generated for tag helper attribute values (for example, `asp-for`) are HTML-attribute-encoded before being rendered, so they are no longer treated as XSS sinks.