Merge pull request #2916 from d2lang/security/render-paint-validation

fix(svg): validate raw render paints