Swap out simple-xss for sanitize-html

Advantages:
* **Works** unlike simple-xss
* Lots of maintainers/contributors
* Smaller than simple-xss
* Correctly allows sanitizing text **first** then applying markdown
* Optional list is included for current defaults... this **can be removed** but I would feel safer matching it in case something comes down the line we don't like.
* Does filter out `javascript:` items just like xss

[npm homepage](https://www.npmjs.org/package/sanitize-html)
[gh homepage](https://github.com/punkave/sanitize-html)

Related:
* #168
* #125

Tested in dev on [this page](http://localhost:8080/scripts/marti/httplocalhost.localdomain/RFC_2606%C2%A73_-_license_and_licence_Unit_Test)
Flip order of processing and allow img tag

* Swap to markdown first then sanitize-html to allow html code blocks
* Allow img tag ... this deviates from their defaults so we need to define our own.
Revert last commit... otherwise DOM is stripped of highlighting capabilities even though it doesn't currently work
Match some of [GH's](https://github.com/github/markup#html-sanitization) stuff.

* Still need to see if sanitize-html has a wildcard
Move html whitelist to a json file so it doesn't clutter up the main code and read in
White space adjustment and removal of console message.

* Prepping for when I get back
Rename json to be more specific and change affected code

* Gotta run now
Use sanitizer for the html renderer. Closes #190.
Merge branch 'Martii-fixXSSandMD'