document the HTML sanitization whitelist

Since this information is important for understanding how AsciiDoc is rendered on GitHub, among other markup languages, I've documented the behavior as I understand it from studying the HTML sanitization filter.