Readme tweaks: add FAQ section, refresh 3rd party extensions

Describe a best practice for maintaining a sanitization whitelist. See https://github.com/jch/html-pipeline/pull/39 for some background.