fix: harden attribute escaping

[matthewp]

Changes

• Removes a special case in addAttribute() that skipped escaping for URL values containing &
• All dynamic attribute values now go through consistent escaping via toAttributeString()
• Removes the now-unused isHttpUrl helper

Testing

• packages/astro/test/units/app/url-attribute-xss.test.js (new)
• Updated assertion in packages/astro/test/astro-attrs.test.js

Docs

N/A, bug fix

[changeset-bot]

🦋 Changeset detected

Latest commit: 3ec0f35

The changes in this PR will be included in the next version bump.

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[codspeed-hq]

Merging this PR will not alter performance

✅ 18 untouched benchmarks

---

_{Comparing sec-attr-amp (3ec0f35) with main (e6e146c)¹}

Footnotes

1. No successful run was found on main (29682f3) during the generation of this report, so e6e146c was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩