GHSA-xgx4-2wgv-4jhm: PDFME has XSS via Unsanitized i18n Label Injection into innerHTML in multiVariableText propPanel

The multiVariableText property panel in @pdfme/schemas constructs HTML via string concatenation and assigns it to innerHTML using unsanitized i18n label values. An attacker who can control label overrides passed through options.labels can inject arbitrary JavaScript that executes in the context of any user who opens the Designer and selects a multiVariableText field with no {variables} in its text.