Update HLJS, improve Markdown.whiteListTag

 1. If a regex is passed to Discourse.Markdown.whiteListTag, it is now auto-anchored. This prevents accidental security holes. (See the 'fa-spin incident'.) 22a4cec, 64be345
 2. Updated HLJS using a bundle with every language checked. If some turn out to be issues (e.g. Applescript) we may want to remove them. (note: seems like we already had AS included?) 173f772, d4dfc34
 3. Changed the code dialect to output `lang-`-prefixed text. This is generally safer in terms of preventing security holes. (fa-spin...) a29e630
 4. Added https://meta.discourse.org/t/voluntary-rel-nofollow-stripped-from-regulars-post/19768