[css-syntax] custom property names too permissive, require namespacing rules

Originally raised on CSS Variables, but later discussion concluded the best fix is to change CSS Syntax. Original post below:

https://www.w3.org/TR/css-variables-1/#defining-variables

A custom property is any property whose name starts with two dashes (U+002D HYPHEN-MINUS), like --foo. The production corresponds to this: it’s defined as any (a valid identifier that starts with two dashes), except -- itself, which is reserved for future use by CSS. Custom properties are solely for use by authors and users; CSS will never give them a meaning beyond what is presented here.

The above text defines the custom property name as "any valid identifier". Tracing that definition back to CSS Values and thence to ident token, we find that the name can contain any Unicode code point > U+0080. This includes various special forms of whitespace as well as potential problem characters, such as bidi controls (such as might cause "Trojan Source" attacks). Namespacing is definitely a complicated problem: the I18N WG doesn't want groups to cherry-pick characters (thereby excluding certain languages from using the feature).

Most programming languages attempt to address this by adopting some form of restriction for variable names such as those found in UAX31 Unicode Identifier and Pattern Syntax. In JavaScript, for example, the definition looks like the one found here. CSS should make similar restrictions on property names (values can remain unrestricted).

Start with the CSS Syntax identifier and dashed-ident definitions, then review the linked CSS Variables, CSS Values, and UAX31 references. Read the 26-comment discussion to understand the unresolved namespacing constraints. Done means reaching agreement on the restriction and reflecting it in CSS Syntax without unnecessarily excluding languages.