Adds sanitize support for fundraiser tokens plus performance bugfix.

## Changes

 - token_replace() supports an options array that includes a sanitize option. The option defaults to TRUE. I added support for this option to fundraiser tokens. The token values will now be run through check_plain() if sanitize is enabled.
 - There's an if statement using a single equals that is meant to be double equals. This causes the code to run for every single token group during a replace. This condition now matches the example code in hook_tokens() which is probably what was intended.
 - There was some code that was checking if $donation was not empty and doing some extra stuff. That should all be in the main condition because $donation would always be empty unless the code in the main condition was run. This also now more closely matches the hook_tokens() example code, which included similar lines but inside the main condition.

## Implications

Because of the last two issues, I suspect this code was executed in instances where it wasn't needed. For example, if there were no [donation:*] tokens in the original string but a donation was passed in the $data as part of the context, this would still execute for every single token group. The point of checking $type is to avoid extra work when tokens in that group aren't used in the original string.

## Tests

I created an acceptance test at https://github.com/JacksonRiver/acceptance-tests/blob/master/tests/acceptance/webform/WebformConfirmationXSSCept.php and confirmed that it fails before the code change and passes after.

Again, this requires $donation to be set, which only happens inside the main condition.