Parser bug, allowing XSS from CSS (On demo)

The following input tested on https://automattic.github.io/juice/
```js
audio{a" onerror=alert(document.domain)>":""}

```
Resulted in the valid XSS payload
```js
": '';">
```
From what I can tell juiceDocument is not affected.

Reproduce the payload on the linked Juice demo and compare its behavior with juiceDocument, which the report says is unaffected. Trace the parser path that turns the style rule into the audio element's style attribute, then add coverage showing that this input cannot produce an executable onerror attribute.

Written by the indexing model from the issue text.