use textContent instead of innerHtml, preventing XSS

[tanhauhau]

Fixes #3813

Added a new concept here, is_static_content besides the can_use_innerhtml

to differentiate cases where we can use innerHtml:

• no mustache tags
• logic blocks, if, each, etc

and cases where the content is static:

• no dynamic dependencies
• only mount, will not need to handle changes.

[Rich-Harris]

ah, whoops. good fix, thanks

[snoopysecurity]

Hey @Rich-Harris, any plans a pushing a new release to npm with this fix? Thanks 😊

[Conduitry]

The last cut version (3.13.0-alpha.2) was before #3808, which introduced the issue.

[snoopysecurity]

Ahhh makes sense, thanks @Conduitry