When localizing DOM elements, we currently try to set all attributes we find defined in the localization. There's a sanitization step which filters attributes missing from the default allowed list or attributes which haven't been explicitly allowed with data-l10n-args.

I think we should double down on this sanitization design and make attribute localization pull rather than push. For any given DOM element, the bindings would only format the known allowed attributes.

This would allow the low-level code in Localization to never have to inspect the inner representation of a message, as it does right now: