google-caja r5669
sanitize CSS

rather than removing it entirely
default to allow_css = false
remove security.is_safe
remove struct-returning sanitize

only keep str-str sanitization
Add Trust Notebook to File menu
cleanup test_nbmanager

use class setUp / teardown instead of the same context manager in every test
disable trust notebook menu item on trusted notebooks
remove warning for stripped output