Sanitize HTML after markdown rendering

This uses the lxml cleaner, and still allows embedded objects such as `<object>` or `<iframe>`.