[MEDIUM] svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences

PKSA-6j95-1jtb-x6wc CVE-2026-107381 GHSA-m9xh-6747-9r6f

Affected package: enshrined/svg-sanitize

Affected version: <=0.22.0

Reported by:
GitHub