fix(server-renderer): use ssrRenderClass helper for className attribute (#14327)

fix https://github.com/vuejs/core/security/advisories/GHSA-5c3j-59mh-x5gj

packages/server-renderer/__tests__/ssrRenderAttrs.spec.ts

@@ -154,7 +154,7 @@ describe('ssr: renderClass', () => {
       ssrRenderAttrs({
         className: ['foo', 'bar'],
       }),
-    ).toBe(` class="foo,bar"`)
+    ).toBe(` class="foo bar"`)
   })
 })
 

packages/server-renderer/src/helpers/ssrRenderAttrs.ts

@@ -38,12 +38,10 @@ export function ssrRenderAttrs(
       continue
     }
     const value = props[key]
-    if (key === 'class') {
+    if (key === 'class' || key === 'className') {
       ret += ` class="${ssrRenderClass(value)}"`
     } else if (key === 'style') {
       ret += ` style="${ssrRenderStyle(value)}"`
-    } else if (key === 'className') {
-      ret += ` class="${String(value)}"`
     } else {
       ret += ssrRenderDynamicAttr(key, value, tag)
     }