use Object.create(null) to create all parsed objects

[autopulated]

Prevent parsing of documents containing tags or attributes named __proto__ from overwriting the prototype on returned objects (See #593)

This is a breaking change, and will break any users of this library which use, for example .hasOwnProperty on the returned objects. (The tests here have been updated to avoid this).

[coveralls]

Coverage remained the same at 97.74% when pulling 581b19a on autopulated:master into 1832e0b on Leonidas-from-XIV:master.

[OIRNOIR]

This PR is even more important to merge because it Closes #663.

[OIRNOIR]

@Leonidas-from-XIV What do you think? This PR will fix the exploit reported against the latest version.

[Leonidas-from-XIV]

I am sort of wondering if this needs to be a breaking change? I could imagine just checking for __proto__ would be enough.

[Leonidas-from-XIV]

Actually, scratch that, you can inject shenanigans like hasOwnProperty as well I guess, so this would be an utter mess to try to capture.