The namespace handling of the HTML sanitizer doesn't match browsers inside HTML integration points

In restricted HTML cleaning, the sanitizer computes the namespace of each element (HTML, SVG or MathML) to decide which elements are allowed where. Below an HTML integration point, this computation doesn't match what browsers do:

• Inside the SVG desc and title elements, browsers parse every child element as HTML except svg and math. The sanitizer treats any SVG element there, e.g., g, circle or title, as an SVG element.
• Inside the MathML mi, mo, mn, ms and mtext elements, browsers parse every child element as HTML except mglyph and malignmark. The sanitizer treats any MathML element there as a MathML element.

For example, for <svg><desc><g><title>...</title></g></desc></svg> the sanitizer allows HTML content inside the title element as it considers it an SVG title, while the browser creates an HTML g and an HTML title whose content is text. No case was found where this makes the output unsafe, but the sanitizer's checks are only reliable when they match the browser's parsing.

In addition, DOMPurify, which the sanitizer is based on, no longer treats SVG desc and title (since 3.1.2) and foreignObject (since 3.1.7) as HTML integration points, as a hardening against mutation XSS. HTML content in these elements has hardly any use, as they contain alternative text.

The namespace computation should follow the browser's parsing rules, and HTML content inside SVG desc and title should be removed as in DOMPurify.