Is-element-nonceable should check if the attribute's name |contains| <script or <style>

[evilpie]

1. Chrome/Safari both seem to check if <style/</script is contained in the attribute's name, not just an exact match.
2. @mikewest mentioned this here Prevent nonce stealing by looking for "<script" in attributes of nonced scripts #98 (comment)

(I am actually not quite sure if this is specified correctly, because https://infra.spec.whatwg.org/#ascii-case-insensitive seems to talk about exact matches only?)

[annevk]

I think you're correct that Infra should probably define an operation for this. Could you file an issue on that against Infra?

At the same time, this is probably clear enough to proceed for now and we can improve it even more later on.