This isn't a complete fix because `innerHTML` assignment also occurs
in `insertStaticContent`. But at least this makes the hello-world app
work with trusted types enabled.

I'm still figuring out how to add test cases for trusted types.

Remaining todos:
- [ ] Add test cases for trusted types.
- [ ] Fix `insertStaticContent` to be compatible with trusted types,
we may need a `vue` policy for that case.
- [ ] Add a note in the docs about trusted types compatibility.
- [ ] Allow trusted values to be passed to `v-html` and other props,
this ultimately fixes vuejs/rfcs#614

…p mounting

Because `replaceChildren` isn't supported in all browsers, we still need
to use `innerHTML` to clear the container before mounting the app.

I left the compat mode implementation in `runtime-core` as is because it
doesn't feel right to use a DOM-only API in `runtime-core`.

It seems that the only source of the `content` is the output of
`stringifyStatic` in `compiler-dom`. I guess no additional check is
needed here.

Setting `textContent` to empty string is the equivalent of setting
`innerHTML` to empty string, but it doesn't trigger trusted types policy
violation.

Though maybe not as clear and performant as `trustedTypes.emptyHTML`,
the code is more succint considering that we don't need to check for the
existence of `trustedTypes` before using it.

…d default to false