transfer filtering

trying sandboxing a webapp using WorkerDOM. Currently, the `` attached by the worker thread is executed on the host, so I had to add a filter rule to prevent this.

https://github.com/ampproject/worker-dom/blob/da975ce/src/main-thread/commands/child-list.ts#L38

```diff
- if (newNode) {
+ if (filter(newNode)) {
```

But I think this is too close to implementation detail.

Is there a good place to configure when installing WorkerDOM?

Start with src/main-thread/commands/child-list.ts at line 38 and trace how nodes attached by the worker thread are transferred to the host. Determine where WorkerDOM installation accepts configuration, then define a configurable filtering point whose done condition is preventing selected script elements from executing on the host.

Written by the indexing model from the issue text.