SEC-007: data in the values of an animated link

Error: the page doesn't build until this is fixed.

An SVG animate or set that changes a link's href sets it to each of its values in turn. With data there, a javascript: URL could slip in. to takes one URL, which Hypra checks like any link.

Fails

page(title: "Shoes", description: "All our running shoes, from light racers to trail shoes.") {
  props(promo: Promo)
  h1 "Shoes"
  svg(viewBox: "0 0 100 20") {
    a(href: "/sale") {
      text(x: 0, y: 15) "Sale"
      animate(attributeName: "href", values: promo.links, dur: "10s")
    }
  }
}

error[SEC-007]: data in the `values` of an animated link could run code
 --> page.hypra:7:46
  |
7 |       animate(attributeName: "href", values: promo.links, dur: "10s")
  |                                              ^^^^^^^^^^^
  = help: animate the link with `to`, which blocks URLs that run code, or write the values in the page
  = docs: https://hypralang.dev/rules/sec-007/

1 error, 0 warnings

Fixed

page(title: "Shoes", description: "All our running shoes, from light racers to trail shoes.") {
  props(promo: Promo)
  h1 "Shoes"
  svg(viewBox: "0 0 100 20") {
    a(href: "/sale") {
      text(x: 0, y: 15) "Sale"
      animate(attributeName: "href", to: promo.link, dur: "10s")
    }
  }
}