Cover missing sinks

[koto]

• HTMLElement.manifest
• Link.imagesrcset
• (a|area|svg:a) ping (space separated URLs)

There's also some URLs that don't seem to be used by the user agent in any way:

• blockquote cite
• * itemid
• * itemprop
• * itemtype

[koto]

Blob constructor as well. We should require TrustedHTML if the Blob type is one of the HTML types. It seems fine to allow for contructing Blobs from non-DOMstring arguments.

While usually the blobs are used in new documents, like iframes, where they can simply trigger in-origin XSS from user input, they can also be used to create nodes from strings like this:

b = new  Blob([`<script>alert(1)</script>`], {type: 'text/html'})
xhr = new XMLHttpRequest();
xhr.responseType = 'document'; 
xhr.open('GET', URL.createObjectURL(b), true); 
xhr.send();
// ...
xhr.response.scripts[0] // a new script node.

[koto]

The sinks mentioned in #169 (comment) self-deprecated with TrustedURL.

Blob is complicated, and it seems like TT can't solve it alone. In general, TT are bypassable with a colluding same-origin document (https://w3c.github.io/webappsec-trusted-types/dist/spec/#cross-document-vectors) - a problem that Blobs surface. It looks like a better primitive would be to make Blobs inherit the creator's policies - w3c/FileAPI#142, or allow for cross-origin/sandboxed blob creation, perhaps by default.