Redo extension as a postprocessor only

This makes it work when safe_mode in the Markdown engine
is truthy.

The previous code did not work because it was writing HTML
into the markdown text, which then makes it available to be
processed (in the post stage) by the raw_html processor, which
implemments the safe_mode behavior.

See earlier discussion: https://github.com/cdent/tank/issues/61

Another approach would be to figure out some way to make a BlockProcessor
that distinguishes between `^\*` and `^\* \[[ xX]\]`. I suspect that
might be the more "correct" approach. I didn't pursue it because
there's only so much digging around in markdown I can stand in one
year. And I didn't think of it until I was writing this message.