If it's easy to inline CSS, we can go ahead and do that.

However, this feature as currently conceived does not include the ability to run scripts. I don't think we currently have a good understanding of what it will take to safely run user scripts. Until we figure that out, allow-scripts will remain disabled, so there doesn't seem to be any point in having the report builder deal with scripts.