Sanitize the string tag passed to DOM components

Because we're using innerHTML to generate DOM Elements, we need to make sure that the tag is sane and doesn't try to do injection.

This wouldn't be an issue if we used document.createElement instead.
This is a special case since a dynamic value of `hasOwnProperty` should be valid here. Ideally this would just use a `Map` at some point.

Typically, `hasOwnProperty` polyfills hide certain properties (e.g. for Map polyfills) which wouldn't be needed here. (It's also not a valid polyfill in ES7 because spread properties syntax exposes them. So you need a different technique there.)