fix(builder): safeImageUrl for FeaturesGrid/ContentSlider image sinks + tighten data:image allowlist

FeaturesGrid's <img src> and ContentSlider's CSS background-image url()
were still on safeUrl, which blocks data:image/svg+xml -- inconsistent
with other image sinks already swapped to safeImageUrl and a latent
regression for those two components. Swapped both to safeImageUrl;
left their navigation sinks (buttonUrl/buttonHref) on safeUrl.

Also tightened safeImageUrl's data:image allowlist check to require the
slash (dataimage/ not dataimage), so a bogus MIME like
data:imagehtml/... can no longer slip past the prefix check.

craft/src/utils/escape.test.ts

@@ -162,6 +162,15 @@ describe('safeImageUrl (Bug 2: image-context sink -- data:image/svg+xml is safe
     expect(safeImageUrl(null as any)).toBe('');
     expect(safeImageUrl(undefined as any)).toBe('');
   });
+
+  test('tightened allowlist: blocks a bogus MIME that merely starts with "image" but has no slash (e.g. data:imagehtml/...)', () => {
+    expect(safeImageUrl('data:imagehtml/svg+xml,x')).toBe('');
+  });
+
+  test('tightened allowlist: still allows legit data:image/* subtypes', () => {
+    expect(safeImageUrl('data:image/png;base64,x')).toBe('data:image/png;base64,x');
+    expect(safeImageUrl('data:image/svg+xml,<svg/>')).toBe('data:image/svg+xml,<svg/>');
+  });
 });
 
 describe('safeUrl still blocks data:image/svg+xml (href/iframe/navigation context unchanged by safeImageUrl addition)', () => {

craft/src/utils/escape.ts

@@ -102,7 +102,7 @@ export function safeImageUrl(s: unknown): string {
   if (collapsed.startsWith('javascript') || collapsed.startsWith('vbscript')) {
     return '';
   }
-  if (collapsed.startsWith('data') && !collapsed.startsWith('dataimage')) {
+  if (collapsed.startsWith('data') && !collapsed.startsWith('dataimage/')) {
     // A data: URI whose MIME type isn't image/* -- e.g. data:text/html,
     // data:application/javascript, data:text/javascript. No legitimate
     // image source needs these; block unconditionally.