Problem with first-run html

[dhowe]

[cqx931]

https://github.com/dhowe/AdNauseam/blob/merged-1.9.16/src/js/i18n.js#L34
According to the latest ublock update. Anything else than <a>, <b>, <code>, <em>, <i>, <input>, and <span> will be rendered as plain text. Even class and id name.
If I change the locale to <span>filter lists<\/span>, instead of <span class='link' id='To3pfilter'>filter lists<\/span>, the rendering is fine.
If we don't want to change i18n.js, we nned to delete the class and id name from locale, and add them later in firstrun.js

[cqx931]

firstrun page calls vAPI.i18n.render() to rerender the text for the changing firstrun-button.
But ublock is now using append for rendering i18n, so vAPI.i18n.render() could not be called multiple times and all the text need to be loaded at once.
The changing firstrun-button need to be switched to a css hide/display approach.

[dhowe]

alternatively we can change the i18n.js function, though we need to make sure any tags are safe (this is the underlying issue: gorhill#2084)

[cqx931]

For class/id issue, I think it is better to just remove them from locale, as same effect can be achieved by writing a different css selector.

And the second issue is closely related to the core of this security issue: append instead of innerHTML. So I think it is better to leave the i18n.js unchanged and change the other.

[cqx931]

fixed #786