Improve Markdown.whiteListTag, code dialect

 1. If a regex is passed to Discourse.Markdown.whiteListTag, it is now auto-anchored (surrounded with `^$`). This prevents accidental security holes. (See the 'fa-spin incident'.) 22a4cec, 64be345

 2. ~~Updated HLJS using a bundle with every language checked. If some turn out to be issues (e.g. Applescript) we may want to remove them. (note: it felt like we already had AppleS included?) 173f772, d4dfc34~~ **Removed**

 3. Changed the code dialect to output `lang-`-prefixed text. This is generally safer in terms of preventing security holes. (fa-spin...) a29e630

 4. Added https://meta.discourse.org/t/voluntary-rel-nofollow-stripped-from-regulars-post/19768 18a4139