Sanitize HTML pasted into ckeditor

[tomasr8]

closes #5560

Probably the easiest solution is to use an external sanitizer and sanitize the pasted contents before it gets converted into ckeditor's document model. Otherwise we'd probablty have to use writers or directly manipulate the model.

This library seems nice because it can also filter attributes, tags, etc..
If we don't want to add another library and just care about the styles, we could roll our own sanitizer using the DOMParser to filter the styles (DOMParser is used internally by ckeditor when pasting as well):

export function sanitizeStyles(
  fragment,
  allowedStyles = ['color', 'background-color', 'font-size']
) {
  allowedStyles = new Set(allowedStyles);
  const queue = [...fragment.children];
  while (queue.length) {
    const element = queue.pop();
    const style = element.style;
    const toRemove = [];
    for (let i = 0; i < element.style.length; i++) {
      const name = style.item(i);
      if (!allowedStyles.has(name)) {
        toRemove.push(name);
      }
    }
    for (const name of toRemove) {
      style.removeProperty(name);
    }
    queue.push(...element.children);
  }
  return fragment;
}

[tomasr8]

The CSS whitelist is just an example, we probably want to allow more styles than that