✨ feat(clean): per-property inline-style value allowlist

[gaborbernat]

Adds Policy.allowed_styles, a per-element, per-property value allowlist for the style attribute, porting sanitize-html's allowedStyles.

Key it {tag: {property: [pattern, ...]}}, with "*" as a tag matching every element. A declaration survives only when its property is listed for the element's own tag or "*" (their pattern lists union, so either can admit it) and its value matches one of the patterns, using an unanchored re.search — the same semantics as sanitize-html's RegExp.test. Patterns are strings or precompiled re.Pattern, compiled once in Sanitizer.__init__.

Precedence: this narrows on top of the existing css_properties name allowlist and the non-configurable dangerous-value baseline, and never weakens it. A property still has to be in css_properties, and expression() or a url() with a disallowed scheme is dropped even when a caller's pattern would match it. When no rule applies to an element (its tag and "*" both absent), allowed_styles imposes nothing extra. The <style> element body stays governed by css_properties alone, since sanitize-html's allowedStyles targets inline styles.

The narrowing runs inside the existing style-scrub walk; the non-allowed_styles path keeps its current zero-overhead scrub.

from turbohtml.clean import sanitize, Policy

policy = Policy(
    tags=frozenset({"p"}),
    attributes={"p": frozenset({"style"})},
    css_properties=frozenset({"color", "text-align"}),
    allowed_styles={"*": {"color": [r"^#[0-9a-f]{3,6}$"], "text-align": [r"^left$|^center$|^right$"]}},
)
sanitize('<p style="color: #ff0000; text-align: justify; font-size: 40px">Hi</p>', policy)
# <p style="color: #ff0000">Hi</p>

Closes #533

🤖 Generated with Claude Code

[codspeed-hq]

Merging this PR will not alter performance

✅ 63 untouched benchmarks
🆕 1 new benchmark
⏩ 18 skipped benchmarks¹

Performance Changes

	Benchmark	BASE	HEAD	Efficiency
🆕	test_feature[sanitize-styles-spec]	N/A	12.6 ms	N/A

---

_{Comparing gaborbernat:feat/533-allowed-styles (db93818) with main (2bc0633)}

Footnotes

1. 18 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩