"create an element for a token" does not account for duplicate attributes

[annevk]

As far as I can tell the tokenizer creates tokens with duplicate attributes. The idea being that the tree builder throws these away. However, the append operation in step 8 does not do that. We should probably first check if the attribute already exists? (And we should somehow account for attributes on tokens also having a namespace, see "adjust foreign attributes", although maybe that is already sufficiently clear.)

The other problem here is that step 3 seems to grab any is attribute. It should probably be specific that it wants the first one.

Noticed while doing research for w3c/webappsec-csp#98.

[domenic]

As discovered in #1637 (comment) this is handled at an earlier stage; the token will not contain duplicate attributes.