Add a `Safe` renderer to deal with users' input

Since we can't turn on security options by default for the sake of
backward compatibility, let's provide a new renderer object that will
make it easy to deal with, for instance, users' input.

The `safe_links_only` and `escape_html` options are turned on by default
but you can still override them if you prefer `filter_html` for example.

The `block_code` callback doesn't output any class attribute as this can
be unsafe since we can specify existing classes as the language.

Fixes #375 and #384.