Allow modules to alter the list of dangerous attributes used by Xss::filter()

Problem/Motivation

Xss::filter() allows any attribute except a hardcoded list of dangerous attributes (style, on*, etc.). It is currently not possible to alter this list.

Modules could have other attributes that are dangerous when the module is installed.
A typical example would be a module that loads a JS library that uses some custom attributes, some of which are too powerful and should be used by non-admin users.

Steps to reproduce

Proposed resolution

Add a hook that allows adding attributes to the list.

Remaining tasks

User interface changes

Introduced terminology

API changes

Data model changes

Release notes snippet