🐛 fix(clean): decode CSS safety tokens

[gaborbernat]

CSS escapes let active syntax survive raw-character sanitizer checks. Those checks also rejected function-like text inside inert strings and comments. 🔒

The native CSS scanner decodes escaped identifiers and URL values before comparison. It rejects malformed URL tokens and the legacy executable properties behavior and -moz-binding, respects token boundaries, and grows scheme buffers without truncation.

This branch follows #728 because rewritten style values need its final safety pass. The decoded checks close #721.

[codspeed-hq]

Merging this PR will not alter performance

✅ 109 untouched benchmarks
⏩ 30 skipped benchmarks¹

---

_{Comparing fix/721-css-escapes (15dcafc) with main (c7193f0)}

Footnotes

1. 30 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩