Fix the forgiving fallback and EOF-terminated arguments

[jdalton]

Two parse defects from the 2.2.25 compiler rework (7a22775): the forgiving-selector fallback tests a doubled escape that can never match, and three pattern groups lost their EOF terminator. Fixing them needs the argument of a logical pseudo-class delimited by a scan rather than a regular expression, since nesting is involved.

Detail, and how it was checked

Two parse defects from the 2.2.25 compiler rework (7a22775).

The forgiving-selector fallback tests /(:(?:is|where)\x28)/, where the doubled escape matches a literal backslash rather than an opening parenthesis, so an unsupported argument such as ':not(:is(svg|div))' emits "unknown pseudo-class selector" instead of matching nothing.

The linguistic, logicalsel and treestruct groups lost their '(?:\x29|$)' terminator, so ':not([class]' and 'meta[charset="utf-8"' are parse errors rather than being closed by EOF the way the CSS Syntax parser closes any open construct. That is /css/selectors/missing-right-token.html.

Restoring the terminator alone reintroduces the bug it had been papering over: with '[^()]|.' the greedy alternative swallows the closing parenthesis of a nested argument, so ':not(:is(div))' compiles ':is(div))'. A regular expression cannot track nesting, so the argument of :is, :where, :matches, :not and :has is delimited by a scan for the balanced closing parenthesis, honoring quotes and escapes, and falling back to EOF. It returns a match-like array so the compile loop keeps popping the remainder as before.

One more change belongs with these, or the first fix trades a throw for a wrong answer: when the validator cannot read a selector that holds a forgiving list, parse() hands on the fragments the validator did match, each compiled as a selector of its own, so 'div:not(:is(svg|div))' matches every element in the document rather than the divs. It now hands on the selector, whose forgiving argument is already evaluated inside a try/catch.

Extracted from #167 as a standalone change: one file, applies to master on its own, and checked against a fixture to confirm it fixes what it describes and moves nothing else.

References: the spec, the browser source, and what each part was reasoned from

This patch applies to master on its own. The sixteen in this series were checked by cherry-picking them onto master one after another, in this order and in reverse, and all sixteen land without a conflict.

• Spec: https://drafts.csswg.org/selectors-4/#typedef-forgiving-selector-list — a forgiving selector list drops the items it cannot parse.
• Spec: https://drafts.csswg.org/css-syntax/#consume-simple-block — a construct left open at EOF is closed rather than rejected.
• Chromium: https://github.com/chromium/chromium/blob/155.0.8041.1/third_party/blink/renderer/core/css/selector_checker.cc#L2516 — ':is()' and ':where()' match any item in the list.
• MDN: https://developer.mozilla.org/en-US/docs/Web/CSS/:is.