fix: escape closing script tag

if a svelte app is inlined to a browser (i.e. stuffed in between `<script>...</script>` tags instead of loaded remotely), this tag is parsed as a valid closing script tag.

src/runtime/internal/dom.ts

@@ -602,7 +602,7 @@ export function add_resize_listener(node: HTMLElement, fn: () => void) {
 	let unsubscribe: () => void;
 
 	if (crossorigin) {
-		iframe.src = "data:text/html,<script>onresize=function(){parent.postMessage(0,'*')}</script>";
+		iframe.src = "data:text/html,<script>onresize=function(){parent.postMessage(0,'*')}<\/script>";
 		unsubscribe = listen(window, 'message', (event: MessageEvent) => {
 			if (event.source === iframe.contentWindow) fn();
 		});