SECURITY: Prevent XSS by 'data-videopayload'

The Javascript in TMH produced a Dom-based XSS by writing the html from
a 'data-videopayload' attribute into the dom. This patch changes to the
name of the attribute to one that cannot be added in parsed wikitext.

Bug: 56699
Change-Id: I7b1dc9aaffa42e6da9b9ae59b7758511aaaa033d