Core: Support Trusted Types

[tosmolka]

Create HTML from string via custom Trusted Types policy in browsers that support Trusted Types.

This PR fixes #478

[gibson042]

I am not comfortable with the size increase of this PR and don't know if it can come down enough to change that, although something like this could be attempted:

	trustedTypesPolicy = {
		createHTML: function( html ) {
			return html;
		}
	};

	try {
		trustedTypesPolicy = window.trustedTypes.createPolicy( "sizzle" );
	} catch ( e ) {}

[mgol]

I have a problem with this approach. A similar jQuery issue about TrustedHTML support was solved by making sure we don't pass unwrapped TrustedHTML input to jQuery manipulation methods; PR: jquery/jquery#4927.

Here, we're using the API directly and this is a Blink-only API. We've historically tried to avoid relying on such APIs in jQuery & Sizzle.

Note that this patch would still not make jQuery 3.x support TrustedHTML as more changes are required and those changes will only be available in jQuery 4.0. Therefore, this patch only has a potential of fixing Sizzle without fixing jQuery.

Ultimately, the decision belongs to @gibson042 who's the Sizzle lead but at this point of the project lifecycle where we're getting close to deprecating Sizzle and only maintaining it as much as jQuery 3.x needs it, I'm not sure if such changes are worth it, especially with the concerns I raised above.

[mgol]

Also, note that just defining a policy & using it still won't solve all the issues. You can declare in CSP that you not only want to enforce trusted types usage but only allow specific policy names. Such declarations would work with jQuery 4.x now but they'd fail with Sizzle with the current patch.

[tosmolka]

This PR is loosely related to #472 where AdGuard team also proposed TT policy for sizzle.

[mgol]

@tosmolka To be honest, their approach of forking Sizzle makes sense for their use case. We're going to archive Sizzle soon and jQuery 3.7.0 & newer will have their own embedded selector engine based on Sizzle but cleaned up a lot.

The first jQuery version with Trusted Types support will be 4.0.0.