[5.x] Merge additional params after SVG sanitization

[heidkaemper]

This PR makes sure that the SVG tag adds additional parameters after sanitization. This solves the problem of parameters being unintentionally removed by the sanitizer.

Until 5.0 this was possible without any issues:

Antlers:
{{ svg src="logo" x-ref="logo" }}

Result:
<svg x-ref="logo" xmlns="...

But since 5.0 this has changed, as sanitizing is active by default:

Antlers:
{{ svg src="logo" x-ref="logo" }}

Result:
<svg xmlns="...

We can set sanitize="false" of course. But in my opinion, it would be nicer to have the best of both worlds. First sanitizing potentially dangerous code, then merge additional parameters.

This relates to #9948 and potentially to #10161 as well.