Allow span elements through HTML validation

This loosens the rules around HTML sanitisation and validation to allow span
elements. This is required for some [work happening on whitehall](https://www.agileplannerapp.com/boards/173808/cards/6159) to precompute
and store govspeak on HtmlAttachments - the computed HTML contains spans for
numbered headings.