Support dynamic loading coverage feature

Hello alex,

I made a big feature to detect dynamic loading for getting more coverage when testing on browser.

Blanket.js originally instrument scripts which pre-defined in HTML through script element.

If some website using dynamic loading approach to load module such as XHR or appendChild, as we can see those module couldn't be covered and blanket do report nothing. 

See my lazy loading test website: http://rickychien.github.io/lazyload-sample/old/

I noticed this situation and try to find solution then just going round in circles. So I made this patch to support this feature when we use coverage tool on browser. (I think there was not exist such like issue on node)

Making this feature as an option and the way of lazy loading catching is very tricky. :)
See also https://github.com/RickyChien/blanket/blob/support-lazyloading/src/blanketRequire.js#L346-L527

Overwrite original XHR and appendChild API to get instrumented script before executing.
So, tricky way maybe break original behavior however it passed tests on my simple website

http://rickychien.github.io/lazyload-sample/new/  (All scripts have been covered)

Hope you can help me to do this thing if you agree with it. :)
Oh, it will be good if you can create a new branch for this feature?

I didn't understand certain code in blanket so that it break some tests :(   (Patch only target on browser)
I will be much appreciated if you can help to fix these fails.