fix($compile): support merging special attribute names in replace directives

When compiling a `replace` directive, the compiler merges the attributes from
the replaced element onto the template element.

Unfortunately, `setAttribute` and other related DOM methods do not allow certain
attribute names - in particular Angular 2 style names such as `(click)` and `[value]`.

This is relevant when using ngForward with Angular Material, since the `mgButton`
directive uses `replace` and in the former you often use `(click)`.

This fixes the problem but for those special attributes the speed is considerably
slow.

Closes angular#13317
Closes angular#13318

Author: petebacondarwin

src/ng/compile.js

@@ -1229,11 +1229,15 @@ function $CompileProvider($provide, $$sanitizeUriProvider) {
     };
 
     function setSpecialAttr(element, attrName, value) {
-      specialAttrHolder.innerHTML = "<span " + attrName + "='" + (value || '').replace(QUOTE_REGEX, '&quot;') + "'>"
+      // Attributes names that do not start with letters cannot be set using `setAttribute`
+      // so we have to jump through some hoops to get such an attribute
+      // https://github.com/angular/angular.js/pull/13318
+      specialAttrHolder.innerHTML = "<span " + attrName + ">";
       var span = specialAttrHolder.firstChild;
       var attribute = span.attributes[0];
       // We have to remove the attribute from the holder element before we can add it to the destination element
       span.removeAttribute(attrName);
+      attribute.value = value;
       element.attributes.setNamedItem(attribute);
     }