JSX syntax scanner&parser improvements.

* `XJSElement` became descendant of `Expression`.
* Scanner has "inJSXContents" and "inJSXTag" states for:
  * reading dashes (`-`) in JSX tag and attribute names;
  * reading contents of JSX tags as expression containers, nested elements or text if doesn't match any of previous two;
  * reading JSX attribute value strings as-is (no special meaning for escaped characters).
* Creating "missing nodes" as attribute values.