GHSA-jxjr-3g7g-3944: xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator

## Summary An embedded line terminator bypasses the `requireWellFormed` serializer check for element and attribute names. The check was added to fix GHSA-w2rr-34g9-rvrj and GHSA-4w3w-2rp5-g8jm; a name whose first line is well-formed slips past it and is serialized verbatim, so the characters after the line terminator break out of the start/end tag or attribute. Callers who enabled `requireWellFormed` specifically to neutralize those name-injection issues remain exposed. ## Details xmldom builds every grammar production through a shared regexp builder that compiles with the `m` flag. …