fix: Add more prevention of malicious injections - #951

Description

Fixes potential XSS-vulnerable links abusing "border-radius" such as https://streak-stats.demolab.com/demo/preview.php?locale=en&date_format=Y-m-d&border_radius=4.5%27%2F%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E%3Crect%20rx%3D%274.5

• Border radii are converted to numbers.
• Error messages and excluded-day labels are XML-escaped.
• Malformed locales are normalized before formatting.
• Added regression coverage for malicious SVG inputs.

Thanks NXVH for responsible disclosure.

Type of change

• Bug fix (added a non-breaking change which fixes an issue)
• New feature (added a non-breaking change which adds functionality)
• Updated documentation (updated the readme, templates, or other repo files)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)

How Has This Been Tested?

• Tested locally with a valid username
• Tested locally with an invalid username
• Ran tests with composer test
• Added or updated test cases to test new features

Checklist:

• I have checked to make sure no other pull requests are open for this issue
• The code is properly formatted and is consistent with the existing code style
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings

Screenshots