Allow SVG in canBrowserDisplayImage

[yharby]

Adds image/svg+xml to browserImageTypes and treats untyped .svg hrefs as images when allowUndefined is set. Browsers render SVG in <img> with scripts and external loads blocked, so this is safe.

This lets STAC Browser show SVG icons (getIcons). Note that thumbnails, previews and asset images typed image/svg+xml will now also display.

Tests added in tests/link.test.js, npm run check passes.

[m-mohr]

Generally fine, but we may consider the following as SVG seem to have a security problem with scripts potentially and render in a generic (non-size) image tag usually worse than a raster image:

stac-js

• getThumbnails(): sort SVG after raster images, and prefer a raster alternate over an SVG asset (browsers don't sniff SVG, so a mislabeled SVG fails where a PNG still loads)

See also radiantearth/stac-browser#1021 (comment)

[yharby]

Done in 9f1ca1d. getThumbnails() now sorts SVG after raster images, and prefers a raster alternate over an SVG asset.