fix(core): allow css custom variables/properties in the style sanitizer (#33841)

This change enables "var(--my-var)" to pass through the style sanitizer.

After consulation with our security team, allowing these doesn't create
new attack vectors, so the sanitizer doesn't need to strip them.

Fixes parts of #23485 related to the sanitizer, other use cases discussed
there related to binding have been addressed via other changes to the
class and style handling in the runtime.

Closes #23485

PR Close #33841

packages/core/test/sanitization/style_sanitizer_spec.ts

@@ -51,6 +51,9 @@ describe('Style sanitizer', () => {
 
   it('accepts calc', () => { expectSanitize('calc(90%-123px)').toEqual('calc(90%-123px)'); });
 
+  it('accepts var',
+     () => { expectSanitize('var(--my-custom-var)').toEqual('var(--my-custom-var)'); });
+
   it('sanitizes URLs', () => {
     expectSanitize('url(foo/bar.png)').toEqual('url(foo/bar.png)');
     expectSanitize('url( foo/bar.png\n )').toEqual('url( foo/bar.png\n )');