HtmlEditorExtender.Decode: fix removal of insecure HTML

[AlekseyMartynov]

In this PR, I'm rewriting the following part:

AjaxControlToolkit/AjaxControlToolkit/HtmlEditorExtender/HtmlEditorExtender.cs

Lines 176 to 192 in f3241fb

	result = Regex.Replace(result, "[^<]<[^>]*expression[^>]*>", "", RegexOptions.IgnoreCase | RegexOptions.ECMAScript);
	result = Regex.Replace(result, "[^<]<([^>]*)(data\\:[^>]*)>", m => {
	var tagGroup = m.Groups[1].Value.ToLower();
	var urlGroup = m.Groups[2].Value.ToLower();
	if(tagGroup.StartsWith("img") && urlGroup.StartsWith("data:image/"))
	return m.Value;
	return "";
	}, RegexOptions.IgnoreCase | RegexOptions.ECMAScript);
	result = Regex.Replace(result, "[^<]<[^>]*script(?!\\w)[^>]*>", "", RegexOptions.IgnoreCase | RegexOptions.ECMAScript);
	result = Regex.Replace(result, "[^<]<[^>]*filter[^>]*>", "", RegexOptions.IgnoreCase | RegexOptions.ECMAScript);
	result = Regex.Replace(result, "[^<]<[^>]*behavior[^>]*>", "", RegexOptions.IgnoreCase | RegexOptions.ECMAScript);
	result = Regex.Replace(result, "[^<]<[^>]*javascript\\:[^>]*>", "", RegexOptions.IgnoreCase | RegexOptions.ECMAScript);
	result = Regex.Replace(result, "[^<]<[^>]*position\\:[^>]*>", "", RegexOptions.IgnoreCase | RegexOptions.ECMAScript);

Key points:

• New logic is executed only when Sanitizer is not active. Otherwise, Sanitizer does a better job.
• Old code corrupts HTML. The test case explains in detail.
• Resolves font-family: "Brush Script MT" in <style> tag breaks HTML markup #513
• Resolves Bugs in HTML Sanitization #525