( function( $ ) { /** * Sanitize icon markup before injecting it into the DOM. * * The nav-menu toggle/close icons are read from data-* attributes and * rendered as HTML. Only Font Awesome and inline SVG icons are * legitimate here, so every other element — and every event handler or * URL-bearing attribute — is stripped to prevent DOM-based XSS. * * Parsing happens inside a