rhukster/dom-sanitizer: SVG <style> tag allows CSS injection via unfiltered url() and @import directives