GHSA-c7q8-3ch8-vqpv: xmldom: Processing Instruction Target Injection Bypasses requireWellFormed

## Summary `Document.createProcessingInstruction()` in `@xmldom/xmldom` performs no validation on the `target` parameter. The `requireWellFormed: true` serializer option validates only for `:` in the target and a case-insensitive `xml` prefix, but does not check for `>` characters. A `>` in the target breaks the processing instruction boundary (` `), allowing injection of arbitrary content into the serialized XML output. …