This should fix #661 and #683 by only allowing html to be set inside jQuery object
This introduce a minor breaking change -

// old API
bootbox.alert('<b>Hello World!</b>');
// new API
bootbox.alert($('<b>Hello World!</b>'));

So naively using bootbox without sanitizing input should be relatively safe without the risk of XSS

bootbox.alert(`Hello ${user.name}`); 
bootbox.alert(result.message);

I added a few tests to check this changes but since there were no existing tests to verify
the old functionality of html strings so I only added a few basic ones.

I know this is a breaking change and there was a bit of a push back against actually adding it in so I understand if you prefer to keep the old behavior as is.

If you do think this is simple enough to be included in I can probably add another pull request to update the docs