added script element comment wrapping

Implement the suggested "wrap script in html comments rather than stripping" from #625, so that people don't lose their work, but it won't auto-run either. This only affects script elements, so blocked js-enabling attributes are still blocked as before.