Lock sanitize to major version 2

Done because v3 has dependencies that don’t work with jruby

(I'm getting a 403 when I try to push to crowdcompass repo)