Sanitizer API: sanitizing happens after tree constructions

Or at the very least it needs to appear exactly as if it did.

Closes WICG/sanitizer-api#259.

Author: annevk

sanitizer-api/sethtml-tree-construction.sub.dat

@@ -595,6 +595,16 @@ test<div>p</div>tt<p>div</p><test>test</test>
 | <div>
 |   <b>
 
+#data
+<table><div><td>
+#config
+{ "replaceWithChildrenElements": ["table"] }
+#document
+| <div>
+| <tbody>
+|   <tr>
+|     <td>
+
 #data
 <template><div>Hello</div></template>
 #config