Sanitize HTML loaded into the SelectionIndicator

**Note: This is a pull request into the `selection` branch**

This uses Google caja by default, specifically, a slightly tweaked
version of the JsHtmlSantizer object from https://github.com/mapbox/sanitize-caja.