fix: snapshot attributes in DOM.removeAttributes to avoid skipping them (#8189)

* fix: snapshot attributes in DOM.removeAttributes to avoid skipping them

Iterating the live NamedNodeMap from elem.attributes while calling removeAttribute skips the attribute directly after a removed one, so a second dangerous attribute can survive DOM.sanitize. Snapshot the collection with Array.from before iterating.

* docs: add PR number to changelog entry