Additional spec work for links

[bkardell]

Following on to #142 and #227, it seems to me that we should update the privacy bits to mention the addition of <a> and integration with the sanitizer. There's also more work to do to get the IDL/references right. @lukewarlow has gotten https://html.spec.whatwg.org/multipage/links.html#api-for-hyperlink-elements merged to start.

[fred-wang]

Related issue with tab-index: #63

[fred-wang]

OK, I just realized we have a element now:
https://w3c.github.io/mathml-core/#the-a-element 🎉🚀

[lukewarlow]

Yeah, it does need further specifying of the behaviour and IDL though.

[lukewarlow]

We need to do a PR to the sanitizer API (and maybe comment on the HTML PR that is starting to upstream the sanitizer API) that adds MathML <a> as a real concept. <math><a href="javascript:..." is already made safe by the algorithm but code such as document.body.setHTML("<mathml><a href='https://google.com'>Text</a>"); won't be allowed by the "safe" default, despite the same working for SVG and HTML a.

Aka stuff like https://wicg.github.io/sanitizer-api/#built-in-safe-default-configuration needs an entry like below.

    {
      "name": "a",
      "namespace": "http://www.w3.org/1998/Math/MathML",
      "attributes": [
        {
          "name": "href",
          "namespace": null
        },
        {
          "name": "hreflang",
          "namespace": null
        },
        {
          "name": "type",
          "namespace": null
        }
      ]
    },

And while not strictly necessary because of the current blanket stripping of href from mathml elements, it would be good to update https://wicg.github.io/sanitizer-api/#built-in-navigating-url-attributes-list too.