[security] can inject JS into page via markdown files

[lucacasonato]

Currently it is possible to inject javascript into pages that render markdown using, for example, a <img> element. This element has an onload parameter that will execute any JS that is passed to it once is succeeds/fails in loading the image.

Instead of blacklisting tags like we do now - currently only <script> is blacklisted - we should whitelist 'known good' tags like comments and <div>. The whitelist Github uses is more complex and is 'documented' here. It also takes the actual params of the tags into account.