jQuery.parseHTML: Mitigate XSS vulnerability

Scripts passed in event attributes are executed in `parseHTML` immediately,
without any possibility for the user to intervene:

`jQuery.parseHTML('<img src=x onerror=alert(1)>');`

To mitigate this vulnerability `document.implementation.createHTMLDocument()`
should be used as standard context instead of `document`. Now the user has
to set a different context deliberately for this issue to occur.

See also GitHub issue #1505.

**EDIT:** Agreed to the CLA.
We shouldn't be using the `jQuery` under test to make decisions about _what_ to test. Either switch to `supportjQuery` or just drop the `isFunction` and check for existence of `document.implementation.createHTMLDocument`.

Also, this would make a great use of the newly-available [`QUnit.skip`](http://api.qunitjs.com/QUnit.skip/).