Comply with Trusted Types

[shhnjk]

Summary

html2canvas has Trusted Types violation due to use of document.write API which is considered a dangerous sink for XSS. This change fixes that and make html2canvas compatible with Trusted Types.

Fixes: #2858

Test plan (required)

Existing test should be sufficient as there is no change in the functionality. There should be a test to check for Trusted Types violation, but existing test.js has multiple Trusted Types violation, so I wasn't able to use that infra.

[tosmolka]

@shhnjk , what about this fix - https://github.com/niklasvh/html2canvas/commit/ac3e5faafeb9ff359f3e8a0a583cded12fc9df0e - so that we avoid maintaining TT policy? Thanks.

[shhnjk]

@tosmolka, have you checked if your solution actually picks up things like internalSlot or publicId from DocType? If that works, I think your solution is elegant :)

[tosmolka]

@shhnjk , from my tests it works well with name, publicId and systemId (https://dom.spec.whatwg.org/#concept-doctype).

I don't think it works with internalSubset in newer browsers but that's expected as this property was deprecated and is no longer supported there.

[shhnjk]

@niklasvh could you take a look? Thanks!