PostController: Add filter whitelist.
Don’t allow non-whitelisted format methods in Gdn_Format::To().
Don’t check the format against the whitelist in the post controller, just Gdn_Format.
Rename FormatWhitelist to SanitizedFormats and protect it.

This property is actually a static list of formats that are appropriate for Gdn_Format::To(). It shouldn’t really be modified by plugins.
Merge pull request #2123 from vanilla/hotfix/whitelist-inputformat

PostController: Add filter whitelist.