Sanitize HTML messages

[coyotte508]

Either before or after the call to marked.

We probably need to load something like jsdom on the backend (but not the frontend) for dompurify to work.

Inspiration from hub code:

let purify: createDOMPurify.DOMPurifyI;

async function loadDOMPurify() {
	if (purify) {
		return;
	}
	if (typeof window === "undefined") {
		/// To avoid needing the dependency on the frontend, we load it dynamically on the backend
		// eslint-disable-next-line @typescript-eslint/no-shadow
		const { JSDOM } = await import("jsdom");
		purify = createDOMPurify(new JSDOM().window as unknown as Window);
	} else {
		purify = createDOMPurify(window);
	}

[coyotte508]

(maybe simply replacing all < by < before markdown would be enough, IDK)