Misplaced is="..." attribute causes false negatives.

[mikesamuel]

https://gerrit-review.googlesource.com/c/111010/2

<gr-autocomplete
     id="newProject"
     class="newProjectInput"
     is="iron-input"
     ... >

causes polymer-resin to create a <gr-autocomplete> proxy element instead of using the default HTMLElement proxy.

We should recognize when is="..." appears on a non-builtin HTML element, and issue a clear violation report that explains the problem, and then reject the value.

Treat an is attribute as misplaced when the element containing the is attribute

1. has a valid custom element name, OR
2. is an instance of HTMLUnknownElement
3. is a legacy element.

[mikesamuel]

Proposed fix

Change the logic that computes a clean proxy in the presence of an is="..." attribute to do the following:

1. Create a clean proxy as before.
2. If the clean proxy itself has an is="..." attribute set the bad proxy bit
3. Run our element classifier on the clean proxy.
4. If the classification is not (builtin) then classify set the bad proxy bit

Before doing the first in cleanProxy check, check the bad proxy bit, and if it is set, report a misplaced is attribute violation, and return a type-independent innocuous value, possibly null.