fix: the Lottie source is builder-only for users without unfiltered_html (P19)

lottie.innerContent (src → data-lottie-src) makes the frontend load an
animation whose expressions lottie-web runs with eval; it joins the S7 gate
in ValueCleaner, which covers removals and StoredNodeGuard.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

src/Integrations/Divi/Compose/ValueCleaner.php

@@ -56,10 +56,12 @@ final class ValueCleaner
      * path shape at any depth: module.advanced.html(.htmlBefore), module.decoration.attributes,
      * any free-form custom CSS path of any module (css, css.*, title.css.*, css.advanced.customCss),
      * and interactions (ruling P16: *.decoration.interactions – Divi's frontend script applies the
-     * "Attribute" effect with setAttribute, e.g. an onclick handler, and sets cookies/presets).
+     * "Attribute" effect with setAttribute, e.g. an onclick handler, and sets cookies/presets),
+     * and the Lottie source (ruling P19: lottie.innerContent – src becomes data-lottie-src, and the
+     * lottie-web build runs animation expressions with eval).
      */
-    private const BUILDER_ONLY
-        = '/(^|\.)(decoration\.attributes|decoration\.interactions|advanced\.html|advanced\.customCss|css)(\.|$)/';
+    private const BUILDER_ONLY = '/(^|\.)(decoration\.attributes|decoration\.interactions|advanced\.html'
+        . '|advanced\.customCss|css|lottie\.innerContent)(\.|$)/';
 
     public function __construct(
         private ModuleCatalog $catalog,
@@ -137,8 +139,8 @@ final class ValueCleaner
     {
         if (preg_match(self::BUILDER_ONLY, $path) === 1 && ! $this->sanitizer->allowsUnfilteredHtml()) {
             throw new InvalidArgumentException(sprintf(
-                '"%s" (eigenes HTML, CSS, HTML-Attribute oder Interaktionen) ist nur im Divi-Builder änderbar '
-                    . '(oder mit dem Recht unfiltered_html).',
+                '"%s" (eigenes HTML, CSS, HTML-Attribute, Interaktionen oder Lottie-Quelle) ist nur im '
+                    . 'Divi-Builder änderbar (oder mit dem Recht unfiltered_html).',
                 $path
             ));
         }