Prevent style injections

[yhatt]

Local directives about background images have an basic vulnerability of style injection. It can apply any style, and can access to unexpected remote URL by url().

<!-- backgroundSize: "auto;filter:url('https://example.com/unexpeted/')" -->

We create InlineStyle helper class to sanitize unexpected declarations through PostCSS.

🤔 In future, supporting CSP's unsafe-inline is a good idea. If element requires inline style, we assigns only data attribute to the element and themeSet.pack() makes packed CSS includes inline styles.

In image filter syntax, we have already applied escaping passed filter arguments, but current way of escaping CSS is wrong. We have fixed to follow W3C CSS3 Escaping. e.g.: \( ➡️ \28 

CSS.escape or its polyfill will too much escape chars, and it will break filter functions.