Allow async, defer, charset attributes of <script> tag

Required for e.g. Twitter or Instagram embeds, see [related stack overflow question](https://stackoverflow.com/questions/39592548/script-embed-gets-removed-with-html-purifier-latest-4-8-0) for reference

