Sanitized declarative patching

It would be good to have a way to help prevent server side XSS while being able to delegate to the client side HTML sanitizer (which can presumed to be always up to date).

A couple ideas from another thread would be to have some attribute on <template>, i.e. something like:

<template for="marker" sethtml="UNTRUSTED_HTML"></template>

OR

<template for="marker" safe>UNTRUSTED_HTML</template>

As noted, the latter is still susceptible to template closing attacks e.g. UNTRUSTED_HTML="</template><script>doEvil()</script>". I'm not entirely sure of all the corner cases of HTML parsing, but I think the former is safe if we simply replace all quotes in UNTRUSTED_HTML with ".

To minimize risk further (e.g. missing attribute quotes), server environments could use tagged templates (or their language's equivalent, e.g. precompiled templates) to create sanitized patching locations, e.g. in JS this might look something like:

const untrustedHTML = `<script>doEvil()</script>`
const html = safeHTML`
    <p>${ untrustedHTML }</p>    
`;

gets transformed to:

<!-- Create a marker, immediately followed by a safe patch, the script is rejected by the sanitizer -->
<p><?marker id="UUID"?><template for="UUID" sethtml="&lt;script&gt;doEvil()&lt;/script&gt;"></template></p>

Start by reading the proposed attributes, sethtml, safeHTML tagged-template example, and the linked WHATWG discussion. Investigate the HTML parsing and template-closing corner cases described in the issue. Done would require an agreed, implementable proposal for sanitized declarative patching, not just another variation of the examples.