Potential fix for code scanning alert no. 1: Incomplete multi-character sanitization

[f1anderz]

Potential fix for https://github.com/f1anderz/msg-parser/security/code-scanning/1

Use a fixed-point sanitization loop: repeatedly apply the same three replacements until the string no longer changes. This preserves existing behavior while ensuring that any newly exposed on...= (or other targeted patterns) produced by earlier replacements is also removed.

In src/html/sanitize.ts, update sanitizeHtml only:

• Replace the current chained one-pass return html.replace(...).replace(...).replace(...);
• With a do...while loop that:
  • stores previous value,
  • applies the same replacement chain to a working variable,
  • repeats until stable,
  • returns the stabilized result.

No new imports or dependencies are required.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.