Add a `Safe` renderer to deal with users' input

Hello,

Since we can't turn on security options by default for the sake of backward compatibility, let's provide a new renderer object that will make it easy to deal with, for instance, users' input.

The `safe_links_only` and `escape_html` options are turned on by default but you can still override them if you prefer `filter_html` for example.

The `block_code` callback doesn't output any class attribute as this can be unsafe since we can specify existing classes as the language.

Fixes #375 and #384.

/cc @markijbema as discussed on HackerOne

Have a nice day.