Make HTMLFragmentField a whitelist on defaults.

The previous behavior was to allow all elements, attributes and styles unless
some were provided.  I was extending things to work for the hackish Events Board
I'm throwing together and it seemed like it'd be better to just, by default,
not allow any elements, attributes, or styles and selectively start allowing
them once they're provided.  Previously, you could provide ['p', 'a'] as
allowed_elements and that would, in turn, allow all attributes on those, etc.

In the process I also pulled out the attributes, etc so it's easier to extend.