sanitizer: emit a 'sanitize' event

This allows for cleaner separation of concerns; the sanitizer does
not need to know anything about other plugins (e.g. smart text).