give sandboxes access to dom; new api:attachObject

1. message to sandbox is copied into sandbox compartment
2. message from sandbox is copied into out compartment
this means we don't need wrappers; just need to taint at point of
getters and check can-flow-to at point of setters

This means DOM-access can be given to sandbox -- we use wrappers to
enforce IFC for this kind of access. Specifically, the wrappers ensure
that the wrapped access to the DOM succeeds only iff the current label
(in sandbox) can-flow-to-given-privs to the label of the remove
compartment.