[Sanitizer] Add tests for safe + unsafe cases.

[chromium-wpt-export-bot]

This tests for differences between setHTML and setHTMLUnsafe.

Since the html5lib testcase format only supports one result per testcase, we use two testcase files with identical inputs,
one each with the expectations for safe and unsafe variants.

Also, a drive-by fix for an issue uncovered by the tests: The
spec demands we block insertion in a <script> element (in safe cases).

Bug: 356601280
Change-Id: I1fb19f60fdcd7262292a983b548baebcaf43a440
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6039899
Commit-Queue: Daniel Vogelheim <vogelheim@chromium.org>
Reviewed-by: Yifan Luo <lyf@chromium.org>
Reviewed-by: Joey Arhar <jarhar@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1397856}

[wpt-pr-bot]

The review process for this patch is being conducted in the Chromium project.

[dev-ansung]

WPT Command: python3 ./wpt run --channel=nightly --verify --verify-no-chaos-mode --verify-repeat-loop=0 --verify-repeat-restart=10 --github-checks-text-file=/home/test/artifacts/checkrun.md --affected base_head --log-mach-level=info --log-mach=- -y --no-pause --no-restart-on-unexpected --install-fonts --no-headless --verify-log-full --binary=/home/test/build/firefox/firefox firefox

Some affected tests had inconsistent (flaky) results:

Unstable results

Test	Subtest	Results	Messages
/sanitizer-api/sethtml-safety.tentative.html		CRASH: 6/10, OK: 4/10
/sanitizer-api/sethtml-safety.tentative.html	wrapper	PASS: 4/10, MISSING: 6/10
/sanitizer-api/sethtml-safety.tentative.html	Testcase #0, setHTML("test)".	FAIL: 4/10, MISSING: 6/10	can't access property "call", context[method] is undefined
/sanitizer-api/sethtml-safety.tentative.html	Testcase #1, setHTML("<p>Hello</p>)".	FAIL: 4/10, MISSING: 6/10	can't access property "call", context[method] is undefined
/sanitizer-api/sethtml-safety.tentative.html	Testcase #2, setHTML("<div>Hello<script>World</script>xxx)".	FAIL: 4/10, MISSING: 6/10	can't access property "call", context[method] is undefined
/sanitizer-api/sethtml-safety.tentative.html	Testcase #3, setHTML("<div>Hello<script>World</script>xxx)".	FAIL: 4/10, MISSING: 6/10	can't access property "call", context[method] is undefined
/sanitizer-api/sethtml-safety.tentative.html	Testcase #4, setHTML("<svg>Hello<script>World</script>xxx)".	FAIL: 4/10, MISSING: 6/10	can't access property "call", context[method] is undefined
/sanitizer-api/sethtml-safety.tentative.html	Testcase #5, setHTML("<img src="https://bla.com/blubb" onclick="2+2" one="two">)".	FAIL: 4/10, MISSING: 6/10	can't access property "call", context[method] is undefined
/sanitizer-api/sethtml-safety.tentative.html	Testcase #6, setHTML("<img src="https://bla.com/blubb" onclick="2+2" one="two">)".	FAIL: 4/10, MISSING: 6/10	can't access property "call", context[method] is undefined
/sanitizer-api/sethtml-safety.tentative.html	Testcase #0, setHTMLUnsafe("test)".	PASS: 4/10, MISSING: 6/10
/sanitizer-api/sethtml-safety.tentative.html	Testcase #1, setHTMLUnsafe("<p>Hello</p>)".	PASS: 4/10, MISSING: 6/10
/sanitizer-api/sethtml-safety.tentative.html	Testcase #2, setHTMLUnsafe("<div>Hello<script>World</script>xxx)".	PASS: 4/10, MISSING: 6/10
/sanitizer-api/sethtml-safety.tentative.html	Testcase #3, setHTMLUnsafe("<div>Hello<script>World</script>xxx)".	PASS: 4/10, MISSING: 6/10
/sanitizer-api/sethtml-safety.tentative.html	Testcase #4, setHTMLUnsafe("<svg>Hello<script>World</script>xxx)".	PASS: 4/10, MISSING: 6/10
/sanitizer-api/sethtml-safety.tentative.html	Testcase #5, setHTMLUnsafe("<img src="https://bla.com/blubb" onclick="2+2" one="two">)".	PASS: 4/10, MISSING: 6/10
/sanitizer-api/sethtml-safety.tentative.html	Testcase #6, setHTMLUnsafe("<img src="https://bla.com/blubb" onclick="2+2" one="two">)".	PASS: 4/10, MISSING: 6/10

These may be pre-existing or new flakes. Please try to reproduce (see the above WPT command, though some flags may not be needed when running locally) and determine if your change introduced the flake. If you are unable to reproduce the problem, please tag @web-platform-tests/wpt-core-team in a comment for help.

[dev-ansung]

created crbug.com/385785711
@KyleJu @DanielRyanSmith can you help admin merge? Thanks!