The HTML sanitizer allows SVG animations of the href attribute

The secure HTML element sanitizer keeps the SVG attributeName attribute regardless of its value. With an SMIL animation element, attributeName="href" animates the href attribute of a link, and the URL check doesn't apply to animation values such as values=";javascript:alert(1)" as they don't start with a URL scheme.

The animation elements that can animate href (animate, set) aren't allowed by default, so the default configuration isn't affected. However, an administrator who allows them through xml.htmlElementSanitizer.extraAllowedTags makes JavaScript links possible.

DOMPurify, which the sanitizer is based on, removes attributeName attributes whose value contains href since version 3.2.6 (case-insensitively since 3.4.17).

Steps to reproduce

1. Configure xml.htmlElementSanitizer.extraAllowedTags=animate in xwiki.properties.
2. As a user without script right, create a page with:

   {{html}}
   <svg xmlns="http://www.w3.org/2000/svg"><a><animate attributeName="href" values=";javascript:alert(1)" dur="1s" fill="freeze"></animate><text y="20">click</text></a></svg>
   {{/html}}
   

Expected: the attributeName attribute is removed.
Actual: the attribute is kept, and the link is a JavaScript link.