We don't allow allow+remove for global attributes; but we do for per-element attributes.

[otherdaniel]

This is split out from #249:

Config procesing: We currently throw when an element or global attribute is listed in both allow & remove, but not for per-element attributes.

new Sanitizer({elements: ["p"], removeElements: ["p"]})  // throws
new Sanitizer({elements: [{name: "p", attributes: ["id"], removeAttributes: ["id"]}]})  // does not throw.