fix($compile): support merging special attribute names in replace directives

When compiling a `replace` directive, the compiler merges the attributes from
the replaced element onto the template element.

Unfortunately, `setAttribute` and other related DOM methods do not allow certain
attribute names - in particular Angular 2 style names such as `(click)` and `[value]`.

This is relevant when using ngForward with Angular Material, since the `mgButton`
directive uses `replace` and in the former you often use `(click)`.

This fixes the problem but for those special attributes the speed is considerably
slow.

Closes angular#13317

Author: petebacondarwin

src/ng/compile.js

@@ -1229,8 +1229,11 @@ function $CompileProvider($provide, $$sanitizeUriProvider) {
     };
 
     function setSpecialAttr(element, attrName, value) {
-      specialAttrHolder.innerHTML = "<span " + attrName + "='" + (value || '').replace(QUOTE_REGEX, '&quot;') + "'>";
-      var attribute = specialAttrHolder.firstChild.attributes[0].cloneNode();
+      specialAttrHolder.innerHTML = "<span " + attrName + "='" + (value || '').replace(QUOTE_REGEX, '&quot;') + "'>"
+      var span = specialAttrHolder.firstChild;
+      var attribute = span.attributes[0];
+      // We have to remove the attribute from the holder element before we can add it to the destination element
+      span.removeAttribute(attrName);
       element.attributes.setNamedItem(attribute);
     }