Allow passing a string directly to dangerouslySetInnerHTML

In response to #1370 and to move the discussion along.

As far as I understand it, `{__html: X}` is not *really* intended as another safe-guard, but a remnant of how XHP worked/works.

Here's a fully backwards-compatible implementation, with a bunch of test-cases added to ensure correct functioning.