Defense against Mutation XSS attacks [WIP]

[vojtech-dobes]

Fixes #88. Work in progress.

/cc @mishak87: is this correct approach? If this is correct implementation of TrueHTML, then 2 points must be resolved:

• [ ] TrueHTML cannot be used if Object.defineProperty is not available (or broken in IE8) OR XmlSerializer isn't available
• [ ] if TrueHTML cannot be used:
  • [ ] 1. HTML must be sanitized in different way
  • [ ] 2. nette.ajax.js will refuse to update snippet
  • [ ] 3. nette.ajax.js will update snippet but scream about security hole