Rewrite listeners in block-text-node-insertion-into*script-element.html

[fred-wang]

These tests rely on checkSecurityPolicyViolationEvent() and
checkMessage() to register listeners for "securitypolicyviolation" and
"message" events but they are actually called after the DOM mutations
that triggering these events, so that makes the test less readable and
possibly flaky. Instead:

- We rely on existing async APIs from `support/csp-violations.js` to
  listen for the violation events. The finaly "trigger fail" only
  seems to be used to force a final message, so we remove it.

- We tweak checkMessage() so it accepts a function to execute after
  event registration, similarly to what `support/csp-violations.js`
  APIs do.

See https://github.com/w3c/trusted-types/issues/576

Note: some SVG tests are just copies of the HTML tests and look wrong since
the default policy expects to see "SVGScriptElement text" sinks. We rewrite
this a bit in follow-up PRs.