ON_SANITIZE plugins and strip_harmful_tags

plugins can modify $allowed_elements and $disallowed_attributes (backwards compatible)