Fix RequireCrossOriginAnonymous when crossorigin attr is allowed

Caught by
https://pkg.go.dev/golang.org/x/tools/go/analysis/passes/unusedwrite
which is on by default in gopls but apparently nowhere else.

sanitize.go

@@ -762,10 +762,10 @@ attrsLoop:
 		switch elementName {
 		case "audio", "img", "link", "script", "video":
 			var crossOriginFound bool
-			for _, htmlAttr := range cleanAttrs {
+			for i, htmlAttr := range cleanAttrs {
 				if htmlAttr.Key == "crossorigin" {
 					crossOriginFound = true
-					htmlAttr.Val = "anonymous"
+					cleanAttrs[i].Val = "anonymous"
 				}
 			}
 

sanitize_test.go

@@ -3695,6 +3695,10 @@ func TestIssue107(t *testing.T) {
 	p := UGCPolicy()
 	p.RequireCrossOriginAnonymous(true)
 
+	p1 := UGCPolicy()
+	p1.RequireCrossOriginAnonymous(true)
+	p1.AllowAttrs("crossorigin").Globally()
+
 	tests := []test{
 		{
 			in:       `<img src="/path" />`,
@@ -3726,6 +3730,16 @@ func TestIssue107(t *testing.T) {
 					tt.expected,
 				)
 			}
+			out = p1.Sanitize(tt.in)
+			if out != tt.expected {
+				t.Errorf(
+					"test %d failed with policy p1;\ninput   : %s\noutput  : %s\nexpected: %s",
+					ii,
+					tt.in,
+					out,
+					tt.expected,
+				)
+			}
 			wg.Done()
 		}(ii, tt)
 	}