Issue #3636218: Remove ping attributes in Xss::filter()

Adds "ping" to the attributes Xss::attributes() always strips (next to style and srcdoc), with a test case in XssTest::providerTestFilterXssNotNormalized().

Closes #3636218