chore: Use nh3 lib instead of bleach

[EugeneTorap]

#23839 have been superseded by this PR.

SUMMARY

Since bleach is already obsolete/deprecated and will not evolve further, it would be better to switch to nh3, which is not only actively evolving, but also significantly faster than bleach.

Relevant links about nh3:
nh3 docs - https://nh3.readthedocs.io/en/latest/
nh3 github - https://github.com/messense/nh3

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

TESTING INSTRUCTIONS

ADDITIONAL INFORMATION

• Has associated issue:
• Required feature flags:
• Changes UI
• Includes DB Migration (follow approval process in SIP-59)
  • Migration is atomic, supports rollback & is backwards-compatible
  • Confirm DB migration upgrade and downgrade tested
  • Runtime estimates and downtime expectations provided
• Introduces new feature or API
• Removes existing feature or API

[codecov]

Codecov Report

Merging #23862 (cbb12c0) into master (4a3984e) will increase coverage by 0.00%.
The diff coverage is 100.00%.

❗ Current head cbb12c0 differs from pull request most recent head 61ff71e. Consider uploading reports for the commit 61ff71e to get more accurate results

@@           Coverage Diff           @@
##           master   #23862   +/-   ##
=======================================
  Coverage   68.11%   68.11%           
=======================================
  Files        1938     1938           
  Lines       74970    74971    +1     
  Branches     8141     8141           
=======================================
+ Hits        51065    51066    +1     
  Misses      21826    21826           
  Partials     2079     2079           

Flag	Coverage Δ
hive	53.01% <80.00%> (+<0.01%)	⬆️
javascript	54.47% <ø> (ø)
mysql	78.80% <100.00%> (+<0.01%)	⬆️
postgres	78.88% <100.00%> (+<0.01%)	⬆️
presto	52.92% <80.00%> (+<0.01%)	⬆️
python	82.67% <100.00%> (+<0.01%)	⬆️
sqlite	77.39% <100.00%> (+<0.01%)	⬆️
unit	52.81% <100.00%> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files	Coverage Δ
.../src/dashboard/components/gridComponents/Chart.jsx	55.96% <ø> (ø)
superset/reports/notifications/email.py	98.63% <100.00%> (+0.01%)	⬆️
superset/utils/core.py	90.99% <100.00%> (ø)

📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more

[EugeneTorap]

@villebro @dpgaspar About rel="noopener noreferrer" which I added in the unit test assert:

noopener: This prevents a particular type of XSS attack, and should usually be turned on for untrusted HTML.

• the link’s target loading in the same tab where the link was clicked
• the backlink from appearing as referral traffic in the destination site’s analytics

[dpgaspar]

@villebro @dpgaspar About rel="noopener noreferrer" which I added in the unit test assert:

noopener: This prevents a particular type of XSS attack, and should usually be turned on for untrusted HTML.

• the link’s target loading in the same tab where the link was clicked
• the backlink from appearing as referral traffic in the destination site’s analytics

Great!! reading the docs that it's the default for link_rel parameter on nh3.clean.
On an unrelated note found it interesting how nh3 rust python binding is using py.allow_threads to get around the GIL, performant CPU bound tasks 💪

[villebro]

This is great - soon all Python libs will be written in Rust!