jQuery.parseHTML: Mitigate XSS vulnerability

Scripts passed in event attributes are executed in `parseHTML` immediately,
without any possibility for the user to intervene:

`jQuery.parseHTML('<img src=x onerror=alert(1)>');`

To mitigate this vulnerability `document.implementation.createHTMLDocument()`
should be used as standard context instead of `document`. Now the user has
to set a different context deliberately for this issue to occur.

See also jQuery ticket #13921.

**EDIT:** Agreed to the CLA.
Several, actually.

This particular test could go in the base [var/support.js](https://github.com/fhemberger/jquery/blob/parsehtml_2.x/src/var/support.js), but if not then probably in a new core/support.js similar to [manipulation/support.js](https://github.com/fhemberger/jquery/blob/parsehtml_2.x/src/manipulation/support.js).

I have a slight preference for the former, but would opt for the latter if it meant a smaller gzipped output file.