Introducing the CSP Fixer

@devoncarew

Devon: sorry, a couple of unrelated trivial changes have crept in.

I should also add tests.

Also note that I deliberately exposed the feature only in the form of an explicit action. I didn't want to build it into the Bower install/update sequence or anything like that because it's too early and too risky.

> Wow, John, so html5lib is yours? Cool stuff!

Hah, kind of. I did the Dart port from https://code.google.com/p/html5lib/ (note: it moved to github). The authors of it seem to be mostly folk that worked on HTML5 spec and actual browser implementations, so it tends to be really really accurate. We're passing the ~10k tests that existed at the time.

> Did you mean for us to contribute that, or were you volunteering to do that yourself?

Happy to review patches.

> Alternatively, if you suggested a reliable way to tell Polymer flavor of
> HTML from a regular one, that could be a stop-gap solution for now.

Hmmm, depends what you're looking for. Anything in an HTML Import would be a pretty good heuristic.

Another totally different approach would be to turn on source spans. Any nodes that are synthetic shouldn't have a source span (or it will be 0 length). You could either write your own serializer to skip them (serializers are pretty simple, look in https://github.com/dart-lang/bleeding_edge/blob/master/dart/pkg/third_party/html5lib/lib/dom.dart for addOuterHtml/addInnerHtml). Or scan the tree and remove those nodes first.