shadowdao
621bb21d52
FeaturesGrid's <img src> and ContentSlider's CSS background-image url() were still on safeUrl, which blocks data:image/svg+xml -- inconsistent with other image sinks already swapped to safeImageUrl and a latent regression for those two components. Swapped both to safeImageUrl; left their navigation sinks (buttonUrl/buttonHref) on safeUrl. Also tightened safeImageUrl's data:image allowlist check to require the slash (dataimage/ not dataimage), so a bogus MIME like data:imagehtml/... can no longer slip past the prefix check.
