validator: `validateImageUrl` does not support `.avif` and `.svg` image formats

[CryptoExplor]

Problem

In pkgs/snap/src/validator.ts, the ALLOWED_IMAGE_EXTENSIONS set is defined as:

const ALLOWED_IMAGE_EXTENSIONS = new Set(["jpg", "jpeg", "png", "gif", "webp"]);

This means snap authors who use .avif or .svg images in their snap UI will get a validation error even though both formats are widely supported in modern browsers and are common in web development today.

.avif — AVIF is now supported in all major browsers (Chrome 85+, Firefox 93+, Safari 16+). It offers better compression than WebP and is increasingly common for web images, especially for performance-conscious snap authors.

.svg — SVG is universally supported and widely used for icons, logos, and scalable UI elements in snaps. Many snap authors building brand-forward UIs will reach for SVG naturally.

Proposed Fix

Add "avif" and "svg" to ALLOWED_IMAGE_EXTENSIONS:

const ALLOWED_IMAGE_EXTENSIONS = new Set(["jpg", "jpeg", "png", "gif", "webp", "avif", "svg"]);

Note on SVG security: SVGs can embed scripts, so if there are concerns about XSS via SVG, it may be worth adding a note in docs that SVG images are rendered via <img> tags (which neutralize embedded scripts) rather than inline <svg>. If the renderer supports inline SVG, this should be called out explicitly.

Affected File

pkgs/snap/src/validator.ts — ALLOWED_IMAGE_EXTENSIONS constant (line ~17)