Support dynamic loading coverage

Hi Alex,

I made a big feature to detect dynamic loading for getting more coverage when testing on browser.

Blanket.js originally instrument scripts which pre-defined in HTML through script element.

If some website using dynamic loading approach to load module such as XHR or appendChild, as we can see those module couldn't be covered and blanket do report nothing.

See my lazy loading test website: http://rickychien.github.io/lazyload-sample/old/

I noticed this situation and try to find solution then just going round in circles. So I made this patch to support this feature when we use coverage tool on browser. (I think there was not exist such like issue on node)

Making this feature as an option and the way of lazy loading catching is very tricky. :)
See also https://github.com/RickyChien/blanket/blob/support-lazyloading/src/blanketRequire.js#L346-L527

Overwrite original XHR, appendChild, insertBefore and replaceChild to intercept dynamic loading behaviors and then fetch instrumented script before executing. So, this tricky way maybe break original behavior however it passed tests on my simple website

http://rickychien.github.io/lazyload-sample/new/ (All scripts have been covered)

Hope you can help me to do this thing if you agree with it. :)

I didn't understand certain code in blanket so that it break some tests :( (Patch only target on browser)
I will be much appreciated if you can help to fix these fails.