Serialize attribute nodes as the empty string (#36875)

The existing code asserts that attribute nodes are never serialized.
This is wrong, because you can pass an attribute node to
`XMLSerializer::serializeToString`. Instead, the spec mandates that
these are serialized as empty strings
(https://w3c.github.io/DOM-Parsing/#dfn-xml-serialization-algorithm).

Testing: Includes a new web platform test
Fixes: https://github.com/servo/servo/issues/36872

---------

Signed-off-by: Simon Wülker <simon.wuelker@arcor.de>

components/script/dom/servoparser/html.rs

@@ -302,11 +302,10 @@ pub(crate) fn serialize_html_fragment<S: Serializer>(
                     serializer.write_processing_instruction(pi.target(), &data)?;
                 },
 
-                NodeTypeId::DocumentFragment(_) => {},
+                NodeTypeId::DocumentFragment(_) | NodeTypeId::Attr => {},
 
                 NodeTypeId::Document(_) => panic!("Can't serialize Document node itself"),
                 NodeTypeId::Element(_) => panic!("Element shouldn't appear here"),
-                NodeTypeId::Attr => panic!("Attr shouldn't appear here"),
             },
             SerializationCommand::SerializeShadowRoot(shadow_root) => {
                 // Shadow roots are serialized as template elements with a fixed set of

tests/wpt/meta/MANIFEST.json

@@ -627813,7 +627813,7 @@
      ]
     ],
     "XMLSerializer-serializeToString.html": [
-     "6c294e464a5dc787abd4d10281ab2fe0555a0a3c",
+     "352a62c7d5db0710da6819bbc094ebfae46f4099",
      [
       null,
       {}

tests/wpt/tests/domparsing/XMLSerializer-serializeToString.html

@@ -256,6 +256,10 @@ test(function () {
   root.setAttributeNS(XMLNS_URI, 'xmlns:foo', '');
   assert_equals(serialize(root), '<root xmlns="" xmlns:foo=""/>');
 }, 'Check if a prefix bound to an empty namespace URI ("no namespace") serialize');
+
+test(function() {
+  assert_equals(serialize(document.createAttribute("foobar")), "")
+}, 'Attribute nodes are serialized as the empty string')
 </script>
  </body>
 </html>