Add an 'allow-popups-to-escape-sandbox' sandboxing token.

[mikewest]

This patch adds the sandbox-escaping functionality described at 1,
which will allow a sandboxed docuent to spawn new windows without
forcing the set of active sandboing flags upon them. This allows, for
example, a third-party advertisement to be (more) safely sandboxed
without forcing the same restrictions upon a landing page.

[mikewest]

Hi, @domenic and @annevk! Thanks so much for doing the hard work to get things set up for direct, external contributions (and for letting me know about it)!

I have no idea how to generate the spec documents from source, so it's entirely possible that this patch doesn't do the right thing, but hopefully I've correctly understood the idioms in the document (100 columns, <span>-wrapped autolinking, data-x naming for attributes, strange indentation rules, etc).

Does this look like a reasonable approach to resolving https://www.w3.org/Bugs/Public/show_bug.cgi?id=28817? If so, wonderful. I have a million more patches for you. :)

[domenic]

I have no idea how to generate the spec documents from source, so it's entirely possible that this patch doesn't do the right thing

Yeah, we need to document this. Would you mind giving the procedures set up in https://github.com/whatwg/html-build a try? Note that it's kind of sucky in two ways, currently:

• You have to build a Free Pascal program. We should look in to providing precompiled binaries for this.
• You have to check out the build tools, but then also put the spec source (and cldr data) into that directory. And, the build tools will then output to that directory. So it's hard to disentangle which came from where.

I have visions of a web service that you upload a source file to and get out a singlepage.html, similar to Bikeshed, but that's not here yet.

Would love your feedback on the build process, if you can manage to get it working. Any that you can give will be incorporated into the readme.

[annevk]

@bzbarsky would you please go over this pull request to see whether you catch anything obviously wrong? Auxiliary browsing contexts is not my strong suit.

[bzbarsky]

Looks reasonable to me.

[annevk]

Thank you @bzbarsky.

@mikewest, could you drop the period from the first line of the commit message and merge the two commits into a single commit using git push --force? That would make it easier to make a clean merge. Thank you.

[mikewest]

Will do, whenever I can get to a computer today.

[mikewest]

Rebased, thanks!