A few APIs already support [LegacyNullToEmptyString], this extends it to various
setInnerHTML (Element, DocumentFragment, Template) and a few other places.
Also changes how Range.createContextualFragment. Unlike other fragment parsers
(e.g. setInnerHTML) this one _does_ run scripts.