Explicitly blacklist unsafe elements, starting with `<script>`

Are there are any other elements that might be considered unsafe?
Make more core strings be translateable

Now we’re translating strings that occur in JavaScript modules.

Partially fixing #491