feat: allow innerHtml if no dynamic dependencies

[tanhauhau]

if the mustache tag expression do not change, can use innerHtml.

For a this hello world example, saved 361 bytes without minified:

• without this PR (1650 bytes)
• with this PR (1289 bytes)

Before submitting the PR, please make sure you do the following

• It's really useful if your PR relates to an outstanding issue, so please reference it in your PR, or create an explanatory one for discussion. In many cases features are absent for a reason.
• This message body should clearly illustrate what problems it solves. If there are related issues, remember to reference them.
• Ideally, include a test that fails without this PR but passes with it. PRs will only be merged once they pass CI. (Remember to npm run lint!)

Tests

• Run the tests tests with npm test or yarn test)

[mustafa0x]

Suggestion: wouldn't it make more sense to use textContent instead of innerHTML?

Edit: I'm actually don't think that that is applicable here, sorry!

[Rich-Harris]

Damn, this is nice! Took me a minute to work out why the lifecycle order is subtly different in that one case, but having understood it (at present, logRender is called before the fragment is actually 'created'), I think the behaviour in this PR is more correct, and it would make more sense if functions like logRender were always called in the c() method rather than at the let declaration site.

Found myself wishing that our hydration was smart enough that we could skip subtrees, making it possible to use innerHTML in that case as well but only if it has in fact changed. That's a conversation for another time though.

[tanhauhau]

I havent really understood how svelte hydration works yet, but I guess I would have more bigger changes, that's why I left it as it is 🙈

[tivac]

Does the change from using text() to create a Text node to using innerHTML open svelte up to a lot more XSS risk? Looking at the diff and playing around with the old method vs the new method makes it look like it might.

https://flems.io/#0=N4IgZglgNgpgziAXAbVAOwIYFsZJAOgAsAXLKEAGhAGMB7NYmBvEAXwvW10QICsEqdBk2J4hcYgAI4AJ2qSAvJIA6IADwAjacQCesBQHI6UWjMSSZMACYBuAwD4ASgFEAIgH4AhO7UB6DfaqNspoIb6+kgBCMGCmMJIAxADMABwADCkh4lIaMXGKkla01ACuOAz41JYYjM6w5cQAFKquAJIAaqoAlMFo2ZKMAB5SSkWlDZXVjAAqMMMAcrRWMI2y1D0hIbmxlvgYAA77TFYAwoTQVo1DxBuhaGNlIvgaSzp7h8dnF43bcV2baHCkgAgmBGDJEqkMll6BJJPsIaNio8KlUYDUYHUYA1miA2p0QLcQgj8BA0GgYDIABLTACyABkCmteiEHhMXlY3gcjvcvlBLgiupQQHAYLBqMQILC8ABGNKIGUAFjYHBAmBweEqcAENHojGYPDYAF1WEA

[Conduitry]

Yeah this is definitely bad.

<div>{'<div onclick="alert(&quot;oh no&quot;)">click me</div>'}</div>

[tanhauhau]

My bad for the security regression, i've made a PR to fix it:
#3816