Replace bleach

[jeriox]

Bleach is deprecated, we need to find a replacement

mozilla/bleach#698

[gaborbernat]

One candidate: turbohtml's clean.sanitize — an allowlist scrubber over a maintained WHATWG parser, typed, with a sanitize_report that returns what it dropped. It also does linkify and escape-mode control. It is a clean-break API, not a bleach drop-in, so expect a policy port; the docs have a bleach migration guide. https://turbohtml.readthedocs.io/en/stable/migration/bleach.html (Disclosure: I maintain it.)