GHSA-83rm-6c8r-g728 - Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages

### Summary When `escapeParameter` is enabled (`escapeParameterHtml` in the Legacy API), Vue I18n passes the translated string through `sanitizeTranslatedHtml()`. The sanitizer escapes `<` and `>` in attribute values and neutralizes event handler attributes such as `onerror`, but it does not handle the `srcdoc` attribute of `<iframe>`. The value of `srcdoc` is an HTML document: the browser decodes the character references in it and parses the result as a nested document in the same origin. The escaping and the neutralization done by the sanitizer are both character references, so they are undone inside `srcdoc`. This bypasses the fix for CVE-2025-53892 (GHSA-x8qp-wqqm-57ph). ### Details `sanitizeTranslatedHtml()` ([`packages/shared/src/sanitize.ts` in v11.4.13](https://github.com/intlify/vue-i18n/blob/v11.4.13/packages/shared/src/sanitize.ts#L126-L162)) works on the final translated string: 1. It escapes `<`, `>`, `"` and `'` inside quoted attribute values. 2. It rewrites the `on` of event handler attributes to `&#111;n`. 3. It replaces `javascript:` URLs in `href`, `src`, `action` and `formaction` with `about:blank`. Inside `srcdoc`, steps 1 and 2 only produce character references, which the browser decodes before parsing the value as a document. Markup inside `srcdoc` therefore survives the sanitizer, with escaping or without it. This can be reached in three ways: - **A parameter inside `srcdoc`.** With a message such as `<iframe srcdoc="{content}"></iframe>`, `escapeParameter` escapes `content` into character references, and the browser decodes them again. - **Markup in a message.** A message that contains an `<iframe srcdoc="...">` keeps it after sanitizing. The documentation asks not to use HTML messages with content from users, but it also says that the sanitizer neutralizes event handlers in the final HTML. - **Together with GHSA-8rc2-428q-7ww3.** When a call passes a list and named values, the named values are not escaped. An `<iframe srcdoc="...">`