Formal Foundations for Provably Safe Web Components