Implement Settings > Media's "Allow SVG uploads" toggle (v2.3.0)

The toggle existed in the UI with no implementation behind it, so
uploads were rejected regardless of the setting. New SvgUploads class:
- Allowlists the SVG mime type and fixes WP's real-mime sniff, which
  otherwise nulls out the file type for SVGs specifically even after
  the mime allowlist is updated.
- Populates width/height metadata (parsed from the SVG's own
  viewBox/width/height) — without this, wp_get_missing_image_subsizes()
  throws undefined-array-key warnings that can corrupt the upload
  response's JSON on environments with warnings displayed inline.
- Basic sanitization on upload (strips <script> tags, inline event
  handlers, javascript: URIs).

Verified live via the REST media endpoint: clean upload with correct
dimensions, and a malicious test SVG had its script/handlers stripped
while staying valid markup.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

CHANGELOG.md

@@ -5,6 +5,21 @@ version bump. Starts at 2.1.0 — earlier history (the theming rebuild,
 window chrome/taskbar, Site Editor support, etc.) lives in `git log` and
 `PROJECT_STATUS.md`, not reconstructed here.
 
+## [2.3.0] - 2026-07-04
+
+### Added
+- Settings > Media's "Allow SVG uploads" toggle now actually does
+  something — previously existed in the UI with no implementation behind
+  it, so every SVG upload was rejected. Fixes both of WordPress's default
+  blocks (the `upload_mimes` allowlist and the real-mime sniff that nulls
+  out the file type for SVGs specifically), plus a PHP warning
+  (`wp_get_missing_image_subsizes()` reading undefined `width`/`height`
+  metadata keys that SVGs never had) that could otherwise corrupt the
+  upload response on environments with warnings displayed inline. Also
+  does basic sanitization on upload (strips `<script>` tags, inline event
+  handler attributes, `javascript:` URIs) since SVG can carry executable
+  content.
+
 ## [2.2.0] - 2026-07-04
 
 ### Added