Whitelist only `for` and `class` attributes on BooleanInput label.

Bug is reported in #995 and exposed through the changes in the spec. I can't figure out _why_ we used to merge our label options into `input_html_options`, but as the TODO previously stated, this is flawed. We should whitelist what we need only, to avoid attributes like `required` falling through.

Closes #995