Keep the first digit of a CSS hex escape

[SashaMIT]

A CSS hex escape dropped its first digit, then kept reading hex digits through the whitespace that is supposed to end the escape. #\31 0, the usual way to name an id that starts with a digit, became U+0010 and matched nothing. \26 B became k instead of &B.

The digit already consumed is part of the value, and one whitespace ends the escape. A seventh hex digit is still an error, same as the existing lexer test. Zero, a surrogate, or a value past the Unicode maximum becomes U+FFFD, which is what the CSS syntax spec returns for those.

link[href*=css\?family] already parses. The selector in #19 writes a second backslash, so that ? is not the escape. This patch does not change that case.

Test plan

• #\31 0 token value is #10, and it matches <div id="10"> but not id="1" or id="310"
• \26 B token value is &B
• "\0a f" is a newline followed by f, and "\0af" is still U+00AF
• go test -count=1 . passed
• Before the fix those expectations failed: the hash token was #\x10, the ident was k, and the string was ¯