Fix filter_xss() to not allow empty style/on* attributes at end of opening tag

Please, see source code of the page to see how the following looks:
empty onsomething event here
empty style attribute here

This is because the check around line 1140 is not completelt accurate.

The fix could look like this:

  // the attribute list ends with a valueless attribute like "selected"
  if ($mode == 1 && $attrname != 'style' && substr($attrname, 0, 2) != 'on') {
    $attrarr[] = $attrname;
  }

I cannot think of any way to include a value for those attributes, so it doesn't look critical, but anyway...