Merge pull request #2256 from aaronshim/trusted-types

Trusted Types compliance by removing calls to .innerHTML