Fix css decoding in the sanitizer

While investigating our handling of the non-IE6 part of bug 55332, I noticed
that our CSS char escape decoding was fairly broken. The regexp was not
adjusted properly for JS, the return values were checking for the empty string
instead of undefined and codepointToUtf8 did not look as if it ever worked
(and used the deprecated unescape method too).

The good news is that the original code does not seem to suffer from the
reported security vulnerability either.

The new code properly decodes the escape and detects the css string as
dangerous.

Bug 55332 also discusses IE6-specific vulnerabilities, but as our current main
user is VE which won't ever be enabled with IE6 we probably don't need to care
any more. I asked for browser stat data in support of a possible
no-session-for-IE6 policy in bug 56575.

Bug: 55332
Change-Id: Ia0230f2258a360749a6cbffff716ed426a207ce9
Merge "Fix css decoding in the sanitizer"