fix OL.type default and TableCell span clamping per spec

OL.type returns "1" (not "") when attribute absent.
TableCell.colSpan clamps to 1-1000, rowSpan to 0-65534.

src/browser/tests/element/html/ol.html

@@ -46,6 +46,6 @@
     testing.expectEqual('1', ol1.type);
 
     const ol2 = document.getElementById('ol2');
-    testing.expectEqual('', ol2.type);
+    testing.expectEqual('1', ol2.type);
   }
 </script>