improvement over PR/14

[adon-at-work]

This is to improve #14:

• a user customizing whitelist should be able to really stop style attributes
• fix a vulnerable test case
• converted attribute list to lower case, otherwise, purifier can be bypassed
• simplified the config logics, it's reasonable to skip copying things around in constructor
• hrefAttributes should be a hardcoded list (ultimately should rely on a single source of truth and a tag-specific list) to judge whether url filter is needed

[adon-at-work]

@maditya , @neraliu , please review.
note: this PR is designed to be first absorbed by taglist-configurable, which will ultimately be (rebased and) merged into master.

[yahoocla]

CLA is valid!

[adon-at-work]

I commented out autofocus and charset temporarily in order to pass their corresponding test cases. They were bypassed by the test cases before this list is lowercased.

Let's discuss the default whitelist tags and attributes. I imagine we'd have a much simpler list.
The current setting is vulnerable. For instance, it enables <iframe srcdoc="">, which is actually scriptable. Allowing <iframe src="http://attacker.com"> is not ideal too.

[maditya]

Allowing <iframe src="http://attacker.com"> is not ideal too.

We can handle this better by allowing user to specify a whitelist of domains. For eg: we should allow <iframe src="http://mydomain.com"> but filter the value for <iframe src="http://attacker.com">

[maditya]

Merging all these changes via cli into #14 and fixing pending items. Closing the PR