fix: escape < in attribute strings

[dummdidumm]

Svelte 4 version of #11411

Before submitting the PR, please make sure you do the following

• It's really useful if your PR references an issue where it is discussed ahead of time. In many cases, features are absent for a reason. For large changes, please create an RFC: https://github.com/sveltejs/rfcs
• Prefix your PR title with feat:, fix:, chore:, or docs:.
• This message body should clearly illustrate what problems it solves.
• Ideally, include a test that fails without this PR but passes with it.

Tests and linting

• Run the tests with pnpm test and lint the project with pnpm lint

[changeset-bot]

🦋 Changeset detected

Latest commit: fb22bd9

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
svelte	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[Pierrci]

Is there any chance this could be backported to Svelte 3, too? 😅

[Uzume]

It seems like this issue was introduced in #5701. This is a great example of both performance sensitive and security sensitive code.

It seems like #8434 is no longer needed as this PR (re)introduces < always being HTML entity escaped in attributes.

[escapedcat]

💁‍♂️ Just a heads up
This is changing an & into & in an image src-attribute for us.
Will stick to 4.2.18 for now.
Eventually might need to upgrade to v5 anyways.

[dummdidumm]

Can you provide a reproduction?

[escapedcat]

Not worth it I think. Wanted to mention it, if other people run into this.
High chance this might be related to a special usage. First time I'm looking into Svelte in an existing project.