Figure out what to do with script.setAttribute('src')

[lukewarlow]

https://w3c.github.io/trusted-types/dist/spec/#setting-slot-values says

Figure out what to do with script.setAttribute('src'). See DOM#789.

We should try to progress that DOM PR as we have renewed implementor interest.

[mbrodesser-Igalia]

Setting milestone to v1 since this is required to avoid XSS.

[lukewarlow]

@koto does your DOM update address this or should it stay open?

[koto]

Yes, it covers that, you can remove the inline issue too.