SECURITY: Disallow -o-link in styles

Opera will execute javascript from -o-link css attributes.

Bug: 58472
Change-Id: I72ad1a0d7e6f9e3d5f51a46c3e4d8a428051de2e
SECURITY: Don't normalize U+FF3C to \

Bug: 58088
Change-Id: If2494d2beca3fff8e3b855a95dee9b35bfda4b03