Correctly handle accessing a replaced Attr object's attribute value.

If element.setAttributeNode(attr) is performed on an "element" with
an attribute that matches "attr.name", that attribute's value is
updated and attr is attached to "element".

Later accesses of "attr.value" must continue to resolve to "element"'s
underlying attribute, matching (local) names following the case
sensitivity of the element.

A normalized local name was previously assumed for the attribute,
leading to crashing conditions on both setting and getting "attr.value".
Address by having Attr record the local name of the element attribute
it is attached to and use that when looking up the attribute.

R=adamk@chromium.org
BUG=376718

Review URL: https://codereview.chromium.org/316583002

git-svn-id: svn://svn.chromium.org/blink/trunk@175556 bbb929c8-8fbe-4397-9dbb-9b2b20218538