Do not install scripts from "script like" pages.

If the origin URL for a script looks like a script, then:

1) The origin URL was a text/html exception which we loaded rather than installing, so:
2) This new URL probably is some kind of exception as well.

The case in question now is the online editor in GitHub which satisfies this case.

Fixes #1875
Clone the responseXML.documentElement in GM_xhr callbacks.

Previously, the documentElement node was adopted instead of imported,
which removes it from its previous ownerDocument. Thus, trying to
adopt the node from a second callback later on would fail due to it
being null.

Creating a clone by using importNode instead ensures that the
documentElement can be used in multiple event handlers.

Fixes #1937
Fixes #1966
Insert a UTF-8 BOM to fix "Show script source".

Fixes #1940
Propagate unsafeWindow Xray waivers into the sandbox.

Context: http://bugzil.la/742444

Fixes #1975