update drupal regex

This should fix #4484

To verify just test it against a vulnerable drupal installation

You can also just verify the old regex matches the same stuff the new regex matches
Guessing the greediness before was matching other attribute values.