Security/Mustache: prevent false positives on block editor templates

[jrfnl]

As reported in 541#issuecomment-1692323177.

This commit fixes the issue + adds a test to safeguard the fix.