操作: 在 TrustedScriptURL CSP 强制下,使 domManip 运行脚本 [trusted-types]

This is a followup to gh-4948. In gh-4949, we stopped stringifying attributes, which makes setting the src attribute on a script tag work under trusted types TrustedScriptURL enforcement via Content Security Policy. However, such scripts are still blocked. This is because in domManip, scripts are not inserted directly but instead first disabled and then their src attributes are read and inserted in fresh scripts.