Cannot preview generated SVG without bundle when icon url include `&` or `<`

[matsubara0507]

Generate SVG from following by d2 --bundle=false

my network: {
  icon: https://icons.terrastruct.com/infra/019-network.svg?fuga=1&hoge
}

Chrome output error message when preview generated SVG (without --watch):

This page contains the following errors:
error on line 21 at column 240: EntityRef: expecting ';'
Below is a rendering of the page up to the first error.

Reason is href attribute value in image tag is included unescaped &. So, I think following rewrite would eliminate the error:

--- a/d2renderers/d2svg/d2svg.go
+++ b/d2renderers/d2svg/d2svg.go
@@ -635,7 +636,7 @@ func drawShape(writer io.Writer, targetShape d2target.Shape) (labelMask string,
 
        case d2target.ShapeImage:
                fmt.Fprintf(writer, `<image href="%s" x="%d" y="%d" width="%d" height="%d" style="%s" />`,
-                       targetShape.Icon.String(),
+                       html.EscapeString(targetShape.Icon.String()),
                        targetShape.Pos.X, targetShape.Pos.Y, targetShape.Width, targetShape.Height, style)
 
        // TODO should standardize "" to rectangle
@@ -679,7 +680,7 @@ func drawShape(writer io.Writer, targetShape d2target.Shape) (labelMask string,
                tl := iconPosition.GetPointOnBox(box, label.PADDING, float64(iconSize), float64(iconSize))
 
                fmt.Fprintf(writer, `<image href="%s" x="%f" y="%f" width="%d" height="%d" />`,
-                       targetShape.Icon.String(),
+                       html.EscapeString(targetShape.Icon.String()),
                        tl.X,
                        tl.Y,
                        iconSize,