high: xmlutil: Sanitize the CIB a bit less aggressively (bnc#866434)

Turns out the CIB was sanitized of all comments in the process.
test: Unit tests for previous commits (bnc#866434)