The attribute is called viewBox with a capital B. Since XML is case-sensitive, the Sane and Dom classes also handle the allowed attributes case-sensitively. Kirby 3.5 used in_array() for this, which also treats the items case-sensitively, so as far as I can tell there was no change to this behavior.
What I wonder is: Does viewbox with a lowercase B actually work? Browsers and SVG editors should ignore it as it uses the wrong case, but it could be that some implementations still support it for compatibility.
To answer your original question: You can add additional allowed attributes to the global allowlist in Kirby\Sane\Svg::$allowedAttrs or you can allow it for specific tags with Kirby\Sane\Svg::$allowedTags['svg'] = ['viewbox'].