fix: always case insensitive event handlers during ssr (#17822)

Fixes events not being stripped on svg, mathml and custom elements.

### Before submitting the PR, please make sure you do the following

- [x] It's really useful if your PR references an issue where it is
discussed ahead of time. In many cases, features are absent for a
reason. For large changes, please create an RFC:
https://github.com/sveltejs/rfcs
- [x] Prefix your PR title with `feat:`, `fix:`, `chore:`, or `docs:`.
- [x] This message body should clearly illustrate what problems it
solves.
- [x] Ideally, include a test that fails without this PR but passes with
it.
- [x] If this PR changes code within `packages/svelte/src`, add a
changeset (`npx changeset`).

### Tests and linting

- [x] Run the tests with `pnpm test` and lint the project with `pnpm
lint`

---------

Co-authored-by: Simon H <5968653+dummdidumm@users.noreply.github.com>

.changeset/proud-seas-study.md

@@ -0,0 +1,5 @@
+---
+'svelte': patch
+---
+
+fix: always case insensitive event handlers during ssr

packages/svelte/src/internal/server/index.js

@@ -154,13 +154,12 @@ export function attributes(attrs, css_hash, classes, styles, flags = 0) {
 		if (INVALID_ATTR_NAME_CHAR_REGEX.test(name)) continue;
 
 		var value = attrs[name];
+		var lower = name.toLowerCase();
 
-		if (lowercase) {
+		if (lowercase) name = lower;
-			name = name.toLowerCase();
-		}
 
 		// omit event handler attributes
-		if (name.length > 2 && name.startsWith('on')) continue;
+		if (lower.length > 2 && lower.startsWith('on')) continue;
 
 		if (is_input) {
 			if (name === 'defaultvalue' || name === 'defaultchecked') {

packages/svelte/tests/server-side-rendering/samples/attribute-strip-svg-mathml-ce/_expected.html

@@ -0,0 +1 @@
+<!--[--><svg><circle cx="12" cy="12" r="10"></circle></svg> <math><mi>x</mi></math> <custom-element></custom-element><!--]-->

packages/svelte/tests/server-side-rendering/samples/attribute-strip-svg-mathml-ce/main.svelte

@@ -0,0 +1,16 @@
+<script>
+  const userdata = {
+    ONCLICK: 'alert(document.cookie)',
+    ONMOUSEOVER: 'alert("XSS")'
+  };
+</script>
+
+<svg {...userdata}>
+  <circle cx="12" cy="12" r="10" />
+</svg>
+
+<math {...userdata}>
+  <mi>x</mi>
+</math>
+
+<custom-element {...userdata}></custom-element>