fix: compatibility with svg-sanitize

[shavonn]

Summary

Require enshrined/svg-sanitize ^1.0 instead of ^0.22.

All versions up to and including 0.22.0 are affected by three advisories published 2026-10-08:

• GHSA-9rjx-3jch-6vjf (CVE-2026-107380): stored XSS via DTD entity / HTML5 named character reference
  collision
• GHSA-m9xh-6747-9r6f (CVE-2026-107381): mixed-case xlink:HrEf skips the <use> nesting DoS check
• GHSA-v383-3rw5-q8rf (CVE-2026-107379): DoS via DTD attribute declaration crash

Composer now blocks 0.22.0. Every release of this package that supports Laravel 13 (v1.1.0–v1.6.0) requires ^0.22, so on Laravel 13 no version can be
installed at all and composer update fails in consuming apps.

0.x is dropped rather than widened to ^0.22|^1.0, because every 0.x release is affected.

Compatibility

The package only uses enshrined\svgSanitize\Sanitizer (IconCompiler), and it behaves the same in 1.0.0. 1.0.0 requires PHP ^7.1 || ^8.0 and
ext-dom/ext-libxml, which this package's PHP ^8.3 requirement already covers.

Testing

• Full suite passes against 1.0.0 (219 tests), including the IconCompiler sanitizer tests (script tags stripped, invalid SVG rejected)
• PHPStan: no errors