<script> tags are only one of many possible attacks that are possible with SVGs. SVG and XML are both quite complex languages that allow different kinds of dynamic imports. Because the reason for our Sane SVG and XML validators is security in the sense of XSS protection, we wanted to ensure that our implementation filters out every property that could be used for an attack and that isn’t needed in most legit SVG files.
Unfortunately many design applications like Affinity Designer, Illustrator and Inkscape use all sorts of legacy SVG syntax for compatibility with the oldest SVG parsers out there. All this syntax isn’t needed in modern browsers and only blows up the file size. Your empty image as exported from Affinity Designer is a good example for this.
I understand that in your case all editors are trusted. If you do want to completely disable our Sane validator, you can use the following in your config.php. Please note though that we do not recommend this for most sites for the security and SVG code-cleanliness reasons I mentioned:
Kirby\Sane\Sane::$aliases = [];
Kirby\Sane\Sane::$handlers = [];
An alternative could be to use plugins or options in your design software to export clean SVGs in the first place. Then you can keep the security feature enabled and will get smaller files as well. I don’t have experience with Affinity Designer personally, so I don’t know if it already comes with a mode that does this. Alternatively you can use tools like SVGO/SVGOMG as already mentioned by James.
Regarding your other questions:
We would love to have that in the future. Implementing that in a secure way is a large task however, so I can’t promise we will get to it in the near future.
Depending on the XML parser it can be. Your example contains an external DTD (document type) definition. If the XML parser downloads that to verify the document structure and an attacker manages to build a DTD that exploits a vulnerability in the XML parser, it can have security implications.
SVG uploads are permitted, but since Kirby 3.5.4 they are validated. Clean SVGs are always permitted.