Ship with rails-html-sanitizer instead.

Should have 4.2.0 label (I don't have access).

cc @chancancode @rafaelfranca 
This test is broken. I think we will need to require the deprecate serializer before requiring the environment to make it pass