Customizable sanitizer

its funny to read `return notSanitized(...)` when the method should return a `SanitizedText` instance. Maybe we should rename this factoryMethod? Also using the classe name would improve readability:

```java
return SanitizedText.fromPlainText(...)
```

Or maybe the `sanitizer.sanitize` should return a `SanitizedText` instead of `String`...