Bugfix 1019925 - Images with Data-URI's now show

I'm a bit worried about adding 'src' to the whitelist, although I understand why you're doing this (you have to as things are implemented! :).  The rationale in bleach.js at https://github.com/mozilla-b2g/bleach.js/blob/worker-thread-friendly/lib/bleach.js#L187 for the "call callback then sanitize" is to ensure that if the function screws up that it doesn't let things through.  I'd characterize this as "fail safe".  I think I was also picturing us wrapping the callback in a try/catch; not having it arguably makes us safer, so that's good.

Anywho, here's what I propose, and @jrburke your feedback is appreciated on this given your involvement in this previously:

1. Let's add a concept of being "blessed" to attributes.  For JS-engine shape/efficiency reasons, let's always initiate it in all cases to false at [https://github.com/mozilla-b2g/bleach.js/blob/worker-thread-friendly/lib/bleach.js#L187

1. Let's change the logic at https://github.com/mozilla-b2g/bleach.js/blob/worker-thread-friendly/lib/bleach.js#L204 to let attributes through that have been explicitly "blessed" by the function.

1. Let's not add "src" to the white-list

1. Let's bless the "src" attribute only in the data URI case.

Heck, I'm gonna name-check @mcav here too.