rails-html-sanitizer is now the default

Also add to upgrading guide a notice about the deprecated sanitizers