M3-4452 Upgrade sanitize-html

[johnwcallahan]

Description

Previously there was an issue where some HTML tags were removed instead of escaped, which led to confusing support ticket bodies (see ticket for more details). This was happening even though we have sanitize-html set to "escape".

It looks like this was a bug in that library. Upgrading the library fixed the issue, with no regressions as far as I can tell.

Note to Reviewers

As a simple example, in production: entering <input /> in the Support Ticket Reply box will yield an empty Preview tab. In this branch, you'll see <input /> in the Preview tab, properly escaped behind the scenes.

Note: there is still some confusing behavior in the library which @acourdavault opened an issue about here: apostrophecms/sanitize-html#334. As an example, <input> yields <input /> (self-closed). This isn't ideal, but not a deal-breaker IMO.

[Jskobos]

All my old gotcha ticket replies are still escaped properly, I think we're good.