Don't mutate `sanitize` config

Since `Hash#dup` in ruby is shallow and the `sanitize` config is nested, duplicating it
isn't enough to mean that changes to the duplicate are side-effect-free. This change changes the
duplication to a deep-merge.

The deep-merge code is a simplified implementation of the [activesupport version](https://github.com/rails/rails/blob/v4.1.4/activesupport/lib/active_support/core_ext/hash/deep_merge.rb#L21).
Merge pull request #29 from alphagov/dont-mutate-sanitize-config

Don't mutate `sanitize` config
Upgrade sanitize dependency to 2.1.0

The older version used by govspeak (2.0.3) contains a bug where colons in
ids would not be allowed, which prevents footnotes being saved as part
of a document body in specialist-publisher.

This was fixed in 2.1.0 (see
https://github.com/rgrove/sanitize/pull/87).

Trying to force an upgraded version of sanitize to be activated using
the specialist-publisher Gemfile is a non-starter as bundle refuses to
upgrade to that version as it's too far ahead of Govspeak's
requirements.