[Vardhman Gupta (Kaap10)]

Description

Closes #3399

Expands data URI detection in XSSOutputScorer beyond text/html to cover executable and scriptable MIME types:

• SVG Data URIs (image/svg+xml): Detects SVG data URIs carrying executable markup across HTML tags (<img src="...">, <object data="...">, <embed src="...">), markdown image syntax (![alt](data:image/svg+xml,...)), and raw payloads.
• JavaScript Data URIs (text/javascript, application/javascript, application/x-javascript, text/ecmascript): Detects script-bearing data URIs across <script src="...">, markdown links, form actions (action, formaction), and bare URIs.
• Boundary Safeguards: Uses trailing boundary (?![A-Za-z0-9+_-]) to avoid false positives on non-standard/unrelated MIME subtypes (e.g. data:image/svg+xml-fake).

Tests and Documentation

• Added parameterized unit test test_xss_executable_data_uris_detected covering 13 test cases across raw SVG, Base64 SVG, markdown image syntax, object data, <script src=...>, JavaScript MIME variants, markdown links, and form actions.
• Expanded test_xss_not_detected with negative controls for benign data URIs (PNG, JPEG, JSON, text/plain, audio/mp3, and fake extensions).
• Added score rationale assertions verifying attribution to "Data URI with Executable Content" and "Bare Data URI with Executable Content".
• Ran unit tests and linters: all 102 XSS & web injection tests and 988 regex scorer tests pass; ruff check and format pass.

[Richard Lundeen (richlundeen)]

Looks good. This extends the existing executable data-URI patterns to SVG and JavaScript MIME types. The MIME boundary avoids treating image/svg+xml-fake as a supported type.

Reviewed with GitHub Copilot.