Move the htmlawed balance before the tag replace.

There are some attacks where an unbalanced script tag won’t get cleaned and then gets balanced.
Add some more tests.