Adding security.js with 1st attempt at is_safe.
Don't render insecure Markdown and show warning.
Display safe HTML+SVG even if untrusted, but don't set trusted=1.
Adding first round of security tests of is_safe.