fix($compile): get $$observe listeners array as own property

Prevent accidentally treating a builtin function from Object.prototype as the binding object, and thus
preventing the compiler from throwing when using attribute binding names which match a property of the
Object prototype.

Closes #9343
Closes #9345
docs($compile): add header to example
docs(guide/compiler): change span to block element in draggable example

The draggable example does not work as expected in Chrome (37.0.2062.124 m).
The span disappears when dragged beyond what appears to be a small area.
Changing the span to a block element (with a width of 65px) resolves this issue.
An alternative solution would be to change the span to a div.
docs($compile): fix a broken link
docs(readme): fix formatting
docs(guide/concepts): improve readability
chore(ngCsp): add e2e tests

Also changes `connect:devserver` and `connect:testserver` to conditionally serve files with csp headers when the path contains `.csp` somewhere.

Closes #9136
Closes #9059
docs(minerr/unpr): note that ctrls cant depend on other ctrls
docs(guide/forms): improve example

When explaining ng-model-options, there's no print of `user.data` to show
the difference between the default behaviour and updateOn: 'blur'
fix(compile): sanitize srcset attribute

Applies similar sanitization as is applie to img[src] to img[srcset],
while adapting to the different semantics and syntax of srcset.