fix(material/stepper): validate animation durations

The `animationDuration` input is a potential CSS injection attack vector, because we pass the value directly along to the `animation-duration` binding. These changes mitigate the risk by validating the incoming value.

Author: crisbeto

src/material/stepper/stepper.ts

@@ -203,7 +203,13 @@ export class MatStepper extends CdkStepper implements AfterViewInit, AfterConten
     return this._animationDuration;
   }
   set animationDuration(value: string) {
-    this._animationDuration = /^\d+$/.test(value) ? value + 'ms' : value;
+    if (/^[0-9]+(?:\.[0-9]+)?$/.test(value)) {
+      this._animationDuration = value + 'ms';
+    } else if (/^[0-9]+(?:\.[0-9]+)?(?:ms|s)$/.test(value)) {
+      this._animationDuration = value;
+    } else {
+      this._animationDuration = '';
+    }
   }
   private _animationDuration = '';