fix(server-renderer): reject CR in attribute names (#15266)