DOM sync removes checkbox custom values in some cases

[SteveSandersonMS]

Repro: <input type="checkbox" value="myvalue" checked>

If you do an enhanced nav and the resulting content also contains that exact same markup, the value attribute will get overwritten with the string true. Then when you submit the form you'll get wrong results.

I tracked this down to a trivial logic error in the DOM sync code - fix submitted in #50991