Fix readonly and type attribute selector incorrect style sharing

RuleSet has a special case in isCommonAttributeSelectorAttribute for
allowing style sharing on elements that match "type" or "readonly"
attribute selectors as long as they have the same value. This was
added long ago in r96393 and worked based on the assumption that
there was logic in canShareStyleWithElement that actually checked
the value of the type and readonly attributes on the style sharing
candidates.

Later in r123730 the type attribute handling was regressed when it
was moved to only check the value for <input>. The readonly attribute
was later regressed in the same way in r134984.

This patch restores the checks those two patches moved but retains the
switch from getAttribute to fastGetAttribute which was likely most of
the performance improvement and fixes the bug where elements would
incorrectly share style even if one of them matched an attribute
selector.

I also don't think we need to worry about SVG's animatable type attribute
since the typeAttr is in the HTMLNames not SVGNames so we'll never get
the svg one and the special case in RuleSet will not match either.

BUG=307170

Review URL: https://codereview.chromium.org/27033011

git-svn-id: svn://svn.chromium.org/blink/trunk@159662 bbb929c8-8fbe-4397-9dbb-9b2b20218538