Swap out simple-xss for sanitize-html

Advantages:
* **Works** unlike simple-xss
* Lots of maintainers/contributors
* Smaller than simple-xss
* Correctly allows sanitizing text **first** then applying markdown
* Optional list is included for current defaults... this **can be removed** but I would feel safer matching it in case something comes down the line we don't like.
* Does filter out `javascript:` items just like xss

[npm homepage](https://www.npmjs.org/package/sanitize-html)
[gh homepage](https://github.com/punkave/sanitize-html)

Related:
* #168
* #125

Tested in dev on [this page](http://localhost:8080/scripts/marti/httplocalhost.localdomain/RFC_2606%C2%A73_-_license_and_licence_Unit_Test)