[XSS] Ignore case of blacklisted HTML elements

[jakelazaroff]

Right now, you can inject script and style tags by using uppercase letters, e.g. <SCRIPT>alert('hi')</SCRIPT>. This PR converts tag names to lowercase before evaluating against the blacklist.

[quantizor]

Makes sense, thanks

[quantizor]

Need to get CI passing though

[codecov]

Codecov Report

Merging #247 into master will increase coverage by <.01%.
The diff coverage is 100%.

@@            Coverage Diff             @@
##           master     #247      +/-   ##
==========================================
+ Coverage   99.72%   99.72%   +<.01%     
==========================================
  Files           1        1              
  Lines         363      364       +1     
  Branches       57       57              
==========================================
+ Hits          362      363       +1     
  Misses          1        1

Impacted Files	Coverage Δ
index.js	99.72% <100%> (ø)	⬆️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 9570018...8ee8010. Read the comment docs.

[codecov]

Codecov Report

Merging #247 into master will increase coverage by <.01%.
The diff coverage is 100%.

@@            Coverage Diff             @@
##           master     #247      +/-   ##
==========================================
+ Coverage   99.72%   99.72%   +<.01%     
==========================================
  Files           1        1              
  Lines         363      364       +1     
  Branches       57       57              
==========================================
+ Hits          362      363       +1     
  Misses          1        1

Impacted Files	Coverage Δ
index.js	99.72% <100%> (ø)	⬆️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 9570018...8ee8010. Read the comment docs.

[jakelazaroff]

@probablyup Sorry, missed that test. Not sure why it only works when I pass the lowercase tag name but should be fixed now.

[keithkade]

Anything else blocking this fix? Snyk recently started flagging for XSS vulnerability.

[quantizor]

Thanks!