Rename FormatWhitelist to SanitizedFormats and protect it.

This property is actually a static list of formats that are appropriate for Gdn_Format::To(). It shouldn’t really be modified by plugins.