fix: encode author names in onerror fallback to prevent XSS

The onerror handlers on testimonial avatar images interpolate t.author
directly into a JavaScript string literal. Because browsers decode HTML
entities before executing event handler attributes, a single quote in an
author name (e.g. O'Malley) breaks out of the JS string and enables
arbitrary script execution.

Apply encodeURIComponent() at build time so special characters are
percent-encoded, which both prevents the string breakout and properly
URL-encodes the ui-avatars.com name parameter.

Affects index.astro (2 instances) and shoutouts.astro (1 instance).

Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>

Author: SebTardif

src/pages/index.astro

@@ -125,7 +125,7 @@ const featuredPress = pressArticles.slice(0, 4);
                 alt={t.author}
                 class="testimonial-avatar"
                 loading="lazy"
-                onerror={`this.src='https://ui-avatars.com/api/?name=${t.author}&background=FF4D4D&color=fff&size=88'`}
+                onerror={`this.src='https://ui-avatars.com/api/?name=${encodeURIComponent(t.author)}&background=FF4D4D&color=fff&size=88'`}
               />
               <div class="testimonial-content">
                 <p class="testimonial-quote">"{t.quote}"</p>
@@ -142,7 +142,7 @@ const featuredPress = pressArticles.slice(0, 4);
                 alt={t.author}
                 class="testimonial-avatar"
                 loading="lazy"
-                onerror={`this.src='https://ui-avatars.com/api/?name=${t.author}&background=FF4D4D&color=fff&size=88'`}
+                onerror={`this.src='https://ui-avatars.com/api/?name=${encodeURIComponent(t.author)}&background=FF4D4D&color=fff&size=88'`}
               />
               <div class="testimonial-content">
                 <p class="testimonial-quote">"{t.quote}"</p>

src/pages/shoutouts.astro

@@ -28,7 +28,7 @@ const allTestimonials = [...testimonials, ...extraTestimonials];
             alt={t.author}
             class="shoutout-avatar"
             loading="lazy"
-            onerror={`this.src='https://ui-avatars.com/api/?name=${t.author}&background=FF4D4D&color=fff&size=96'`}
+            onerror={`this.src='https://ui-avatars.com/api/?name=${encodeURIComponent(t.author)}&background=FF4D4D&color=fff&size=96'`}
           />
           <div class="shoutout-content">
             <p class="shoutout-quote">"{t.quote}"</p>