Test SVG upload sanitizer for security issues

I tested this module in 2 main ways. First, I wanted to determine if there were any ways to upload SVGs that would bypass the sanitization. Second, I wanted to make sure that sanitized SVG files were actually being stripped of harmful markup.

To test the first, I created a content type that allowed File upload with "svg" as a permitted file type. I then created content and added a known-bad SVG file sourced from the online SVG sanitizing tester. After uploading the file I viewed its source and confirmed that changed had been made to the file, the same changes that are made when using Paragon's built-in SVG upload functionality.

Unfortunately in its current state the library does not pass the second test. The fill="url()" code still permits loading from external sources. SVGs loaded in this way would not be caught by this module and could still contain malicious code of their own. If SVGs being able to fill from external sources is still desired, then the module or underlying library will need to detect SVG files being loaded on-the-fly and sanitize them just-in-time. Since this is likely a substantial development effort, a more sensible best practice would be to do as the SVG Sanitizer Test does and convert external fill URLs to relative paths so they cannot reference content across domains. That should not be too difficult to add since it already does this for <a> tags.

This is the only detected failure of the module's sanitization pass. Invalid xlink:hrefs, invalid XML, and XML tags that are not part of the SVG specification are all correctly identified and removed.