Fix sanitizer attribute breakout via href/src charref decoding

[metsw24-max]

Follow-up to the downstream mitigation added in web2py PR #2599: web2py/web2py#2599

This patch fixes the issue at the source in yatl’s sanitizer implementation.

HTMLParser decodes character references before attribute reconstruction. href, src, and background values were not consistently routed through quoteattr(), which could allow crafted payloads to break out of the attribute context after parser normalization.

This change applies the same escaping path already used for other attributes and documents the parser-decoding behavior with an inline comment.

Changes

• Route href, src, and background through quoteattr()

• Add explanatory comment about HTMLParser character reference decoding

• Add regression test:

  • test_sanitize_attribute_breakout
  • Covers multiple payload variants
  • Parses sanitized output with HTMLParser
  • Verifies no injected event-handler attributes survive sanitization

Verification

• Full test suite passes (18/18)
• Confirmed the issue reproduces on unpatched yatl before applying the fix

Why this belongs in yatl

The previous web2py-side mitigation addressed the symptom downstream. This patch fixes the sanitizer behavior directly in yatl so all consumers benefit from the corrected escaping behavior.