Interaction of cloneNode() with CSP

[annevk]

See https://www.w3.org/Bugs/Public/show_bug.cgi?id=25529#c10.

And w3c/webappsec-csp#212.

This is something for @andypaicu and @mikewest to sort through.

(Another potential issue that was raised in the legacy bug is if there's a difference between setting multiple attributes at once (as the parser can do) or one attribute at the time, but nobody could find examples other than custom elements, which are handled separately.)