Unquoted attributes eat unescaped ].

Despite some fixes to the attribute regex, unquoted attribute values still eat unescaped "]" characters and can therefore extend beyond the end of a tag.

(testAttributes() doesn't catch that yet because it a) only tests one tag, which leaves no ambiguity, and b) doesn't have an opening tag where the last attribute is unquoted.)