Remove extraneous div
Move raw markdown into attribute

This allows us to factor out the inline script fragment altogether,
which is good for content security policy.
Move table class to postprocessing step

We don't want to do this as part of markdown rendering, because it makes
our XSS filter more complicated. In general, we do not want to allow the
user to specify their own class attributes. So every class attribute
generated by the renderer becomes a special case for the filter. The
fewer of those, the better.
Remove highlighting from renderer

Same as the previous commit. Highlighting code injects a ton of class
attributes, and the XSS filter would have to give a special pass for
every single one. It's easier to just do the highlighting after the XSS
filtering.