allowAttributes("style").globally() shouldn't imply allowStyling() - Regression with 2024 version

[subbudvk]

This recent breaking changes

• Forces validating global style content with CSSSchema - Earlier we had better options seperately
  allowAttributes("style").globally() - doesn't sanitize, allowStyling() - did sanitize.
• make disallowAttribute("style").globally() now does allowStyling() as pointed out in the PR by someone.

@mikesamuel @jmanico : Can you kindly have a look as we are facing issues after 2024 version upgrade.

Fixes #331

[subbudvk]

@mikesamuel

[csware]

Please also add test cases for the cases that must not happen.

[subbudvk]

@mikesamuel

[jmanico]

Decision: we are not going to take this, and I want to be straightforward about why.

Before #218, allowAttributes("style").globally() without allowStyling() passed the raw style value through untouched. That is an XSS-adjacent footgun in a sanitizer (CSS can carry expression(), behavior:, -moz-binding, url() beacons, and containment escapes), and #218 closed it by making any allowance of style run through the CSS schema. Reverting that would make the library unsafe by default for anyone who reaches for the obvious API. This PR also deletes the test that guards the behaviour and adds no negative tests, which @csware pointed out.

For the underlying need, "our users rely on CSS the default schema does not allow", the supported path is to widen the schema rather than bypass it:

.allowStyling(CssSchema.union(CssSchema.DEFAULT,
    CssSchema.withProperties(Arrays.asList("grid-template-columns", ...))))

and per-element styling is being designed in #381. If a property you need cannot be expressed in CssSchema, please open an issue with the property and we will look at adding it. Closing this and #331.