Rewrite CSS url() and font-family output logic.

The new logic is as follows:

* Given a URL to insert into url(), check that it is properly URL
  encoded (in particular, a doublequote and backslash never occurs
  within it) and then place it as url("http://example.com").

* Given a font name, if it is strictly alphanumeric, it is safe to omit
  quotes. Otherwise, wrap in double quotes and replace '"' with '\22 '
  (note trailing space) and '\' with '\5C ' (ditto).

We introduce expandCSSEscape() which is a hack for common parsing
idioms in CSS; this means that CSS escapes are now recognized inside
URLs as well as unquoted font names.

Signed-off-by: Edward Z. Yang <ezyang@mit.edu>

tests/HTMLPurifier/HTMLT/tidy-background.htmlt

@@ -1,5 +1,5 @@
 --HTML--
 <table background="logo.png"><tr><td>asdf</td></tr></table>
 --EXPECT--
-<table style="background-image:url('logo.png');"><tr><td>asdf</td></tr></table>
+<table style="background-image:url(&quot;logo.png&quot;);"><tr><td>asdf</td></tr></table>
 --# vim: et sw=4 sts=4