fix expand and tabs shortcodes to work with strict Content-Security-Policy

When the Content-Security-Policy header has "style-src 'self';"
inine style elements like style="display: none" are not honored
by browsers, so add CSS to the markup classes and style them
display: none

layouts/shortcodes/expand.html

@@ -4,7 +4,7 @@
       <span>{{ default "Expand" (.Get 0) }}</span>
       <span>{{ default "↕" (.Get 1) }}</span>
     </div>
-    <input type="checkbox" style="display: none" />
+    <input type="checkbox" class="book-expand-expander" />
     <div class="book-expand-content markdown-inner">
       {{ .Inner | markdownify }}
     </div>