CVE-2026-68921: DiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials)

@dicebear/core builds avatar SVGs from caller-supplied options. The numeric rotate option is interpolated into an SVG transform attribute without XML-escaping. It is typed as a number, but nothing checks the type at runtime, so a string value passes straight through and can break out of the attribute to inject arbitrary SVG markup.

This is the same root cause as CVE-2026-33311 (GHSA-mr9r-mww3-v6gv), which escaped the string options backgroundColor, fontFamily, and textColor but did not cover rotate. @dicebear/initials has the same gap in its numeric fontSize and fontWeight options.