Restrict DOM XSS language selection in low security level

[r1kka6]

Summary

• allow only the built-in language values in the low-level DOM XSS handler
• redirect arbitrary default values before they reach the shared client-side document.write() sink

Verification

• docker run --rm -v "$PWD":/work -w /work php:8.3-cli php -l vulnerabilities/xss_d/source/low.php
• vulnerable baseline returns 200 for default=<script>alert(1)</script>
• patched runtime redirects the payload to ?default=English and still serves default=English normally