Swap out simple-xss for sanitize-html

PR is NOT READY... better than what we have and also may have future dependencies
Advantages:
* **Works** unlike simple-xss
* Lots of maintainers/contributors
* Smaller than simple-xss
* Correctly allows sanitizing text **first** then applying markdown
* Optional list is included for current defaults... this **can be removed** but I would feel safer matching it in case something comes down the line we don't like.
* Does filter out `javascript:` items just like simple-xss

[npm homepage](https://www.npmjs.org/package/sanitize-html)
[gh homepage](https://github.com/punkave/sanitize-html)

Related:
* #168
* #125

Tested in dev on [this page](http://localhost:8080/scripts/marti/httplocalhost.localdomain/RFC_2606%C2%A73_-_license_and_licence_Unit_Test)

---

Additional bug report(s):
* https://openuserjs.org/discuss/The_new_layout#comment-146b4da7366

---
MISSING:
* Rest of GH supported attributes on allowed tags... TRACKING UPSTREAM
* Showing raw HTML support in md code blocks
* Resolves html in markup code blocks