Add the 'unsafe-hash-attributes' source expression.

This source expression allows hashes to match both event handlers and inline
style attributes.

Closes #13.
Closes #40.

Author: mikewest