ie-html: fix noscript and plaintext handling in tree builder

[thomasnemer]

Goal

Fix noscript element handling (currently 11%) and plaintext (12%).

Affected test files

• noscript01.dat: 2/18 (11%)
• plain-text-unsafe.dat: 4/33 (12%)
• pending-spec-changes-plain-text-unsafe.dat: 0/1

Implementation needed

• InHeadNoscript mode needs proper handling (currently minimal)
• Plaintext state switching from tree builder
• Raw text handling for noscript content when scripting is disabled

Estimated impact

+30-40 tests passing