Ship with rails-html-sanitizer instead.

Should have 4.2.0 label (I don't have access).

cc @chancancode @rafaelfranca