fix: harden SVG sanitization against XSS vectors (JhaSourav07#1899)

## Description

Fixes JhaSourav07#1897 

Replaces the existing regex-based SVG sanitization in `page.tsx` with a
more secure sanitization approach.

### Changes

* Removed reliance on regex-only sanitization for SVG content.
* Added support for sanitizer-based SVG filtering with an allowlist of
safe elements and attributes.
* Prevented common SVG XSS vectors, including:
  * `foreignObject`
  * `xlink:href` abuse
  * unsafe `data:` URIs
  * CSS `url()` injections
  * inline event handlers
* Improved overall SVG rendering security through defense-in-depth
practices and safer content handling.

## Pillar

* [ ] 🎨 Pillar 1 — New Theme Design
* [ ] 📐 Pillar 2 — Geometric SVG Improvement
* [ ] 🕐 Pillar 3 — Timezone Logic Optimization
* [x] 🛠️ Other (Bug fix, refactoring, docs)

## Checklist before requesting a review:

- [x] I have read the `CONTRIBUTING.md` file.
- [x] I have tested these changes locally
(`localhost:3000/api/streak?user=YOUR_USERNAME`).
- [x] I have run `npm run format` and `npm run lint` locally and
resolved all errors (CI will fail otherwise).
- [x] My commits follow the Conventional Commits format (e.g.,
`feat(themes): ...`, `fix(calculate): ...`).
- [ ] I have updated `README.md` if I added a new theme or URL
parameter.
- [x] I have started the repo.
- [x] I have made sure that i have only one commit to merge in this PR.
- [x] The SVG output matches the CommitPulse "premium quality" aesthetic
standard (no raw elements, smooth animations, correct fonts).
- [ ] (Recommended) I joined the CommitPulse Discord community for
contributor discussions, mentorship, and faster PR support.

Author: JhaSourav07

app/customize/page.tsx

@@ -6,6 +6,7 @@ import { motion } from 'framer-motion';
 import { ControlsPanel } from './components/ControlsPanel';
 import { ExportPanel } from './components/ExportPanel';
 import InteractiveViewer from '@/components/InteractiveViewer';
+import DOMPurify from 'dompurify';
 import type {
   ExportFormat,
   Font,
@@ -142,11 +143,18 @@ export default function CustomizePage(): ReactElement {
       })
       .then((text) => {
         if (!text) return;
-        // Basic SVG sanitization to prevent XSS (strip scripts and inline event handlers)
-        const sanitized = text
-          .replace(/<script[\s\S]*?>[\s\S]*?<\/script>/gi, '')
-          .replace(/on\w+\s*=\s*("[^"]*"|'[^']*')/gi, '');
-        setSvgContent(sanitized);
+        // Sanitize SVG using DOMPurify with the SVG profile.
+        // - Forbid risky tags like foreignObject and embedded content
+        // - Forbid xlink:href to avoid external references
+        // - Use a conservative URI whitelist to prevent javascript: URIs
+        const sanitized = DOMPurify.sanitize(text, {
+          USE_PROFILES: { svg: true },
+          FORBID_TAGS: ['foreignObject', 'iframe', 'object', 'embed', 'script'],
+          FORBID_ATTR: ['xlink:href'],
+          ALLOWED_URI_REGEXP: /^(?:(?:https?|mailto|data):|#)/i,
+        });
+
+        setSvgContent(sanitized as string);
         setSvgState('loaded');
         setErrorMessage(null);
       })