check the type/language of script elements

I tried to prevent allocations, but the slices wouldn't live long enough to check the static array, without duplicating code. Plus, if the `language` attribute is used, a new String is pretty much required.

Maybe if no type and no language are the most common, it'd be worth using `MaybeOwned`, so that `"text/javascript".to_string()` isn't needed?

fixes #2828 
Where does this list come from? Could you add a comment explaining that?