GHSA-x7mm-9vvv-64w8: unhead: Streaming SSR `streamKey` injected into inline script without identifier validation

createStreamableHead({ streamKey }) interpolated its streamKey argument directly into the streaming SSR bootstrap and suspense-chunk inline scripts without identifier validation or escaping. If an application forwards untrusted data into that configuration value, the rendered scripts become a script-injection sink.