Sanitize CSS values

Many tags allow users to directly specify CSS properties - [size], [color], [align], [list] among others.

While Twig escapes these to ensure they can't break out of the style="" attribute, it doesn't do anything about a semicolon. It's a bit silly if [size=1em;color:red] works, since a big point of having these tags at all is to give fine control over what CSS properties can be set.

It might be enough to wrap it in apostrophes.