Revise the escaping

[mattesmohr]

In HTMLKit every String input can become a security issue, so we escape all strings by default. However, there are cases where we can confidently treat certain inputs as safe.

Script {
}
.defer() // No arbitrary input, but it is still a string

Meta()
   .charset(.utf8) // No arbitrary input, but it is still a string

The pull request introduces EscapeContext and makes all the elements and attribute aware of it. It indicates whether the content can be trusted or not and if not, explains the relevant context.

Anchor {
}
.style("...") // Suspicious CSS context

Script {
   ... // Suspicious JS context
}

With the introduction of EscapeContext, TaintedString can be removed.

Customising the context

Custom accepts the context too, therefore you could change the context for the content:

Custom("script", context: .trusted) {
}

Anchor {
}
.custom(key: "style", value: "...", context: .trusted)