fix(chrome): validate attribute name in unknown-prefix branch

A selector like `foo]:has(*),body[x:value` previously produced
[foo]:has(*),body[x="..."], a syntactically valid CSS selector that
escaped the attribute match and selected `body`. Reject anything that
isn't a plain HTML attribute name.

internal/driver/chrome/translate_test.go

@@ -64,6 +64,21 @@ func TestTranslateStringSelector_RejectsMissingPrefix(t *testing.T) {
 	}
 }
 
+func TestTranslateStringSelector_RejectsUnsafePrefix(t *testing.T) {
+	cases := []string{
+		`foo]:has(*),body[x:value`,
+		`x y:value`,
+		`x"y:value`,
+		`*:value`,
+		`(:value`,
+	}
+	for _, selector := range cases {
+		if _, _, err := TranslateStringSelector(selector); err == nil {
+			t.Errorf("%q: expected error for unsafe prefix", selector)
+		}
+	}
+}
+
 func TestCSSEscape_ControlCharactersAndNUL(t *testing.T) {
 	cases := []struct {
 		name  string