Fix XSS on state encoding

[Fryuni]

          _:hammer_and_wrench: Refactor suggestion_

Consider encoding the JSON state for safety.

The state is being directly interpolated into the script tag content. While the json+devalue type suggests special handling, explicitly encoding would prevent XSS.

Consider this enhancement:

-const stateScript = `<script id="it-astro-state" type="application/json+devalue">${state}</script>`;
+const stateScript = `<script id="it-astro-state" type="application/json+devalue">${encodeURIComponent(state)}</script>`;

Committable suggestion skipped: line range outside the PR's diff.

Originally posted by @coderabbitai[bot] in #179 (comment)