[4.0] Expand the allowed list for the HTML sanitiser

[dgrammatiko]

Pull Request for Issue # .

Summary of Changes

By default, the sanitiser will remove all the form elements. This PR changes this behaviour so form elements would not disappear (on* events will still be removed).
The list of attributes comes directly from the MDN: https://developer.mozilla.org/en-US/docs/Web/HTML/Element/input#attributes

Testing Instructions

Apply the PR
Goto admin dashboard and open the browser console
pass some HTML to the sanitiser and check the result:

Joomla.sanitizeHtml(`<input type="text" onchange="alert('nope')" >`);

Check more attributes and elements (button, select, textarea)

Actual result BEFORE applying this Pull Request

Too strict

Expected result AFTER applying this Pull Request

Less strict

Documentation Changes Required

[RickR2H]

@dgrammatiko I applied the patch and added to the console: Joomla.sanitizeHtml(<input type="text" onchange="alert('nope')" >);
Got the following in return: "<input type="text">"

Is this correct?

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/34518.}

[dgrammatiko]

Is this correct?

Yes, the onchange="alert('nope')" is Javascript so correctly was removed by the sanitizer

[RickR2H]

I have tested this item ✅ successfully on 1fe402d

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/34518.}

[jwaisner]

I have tested this item ✅ successfully on 1fe402d

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/34518.}

[jwaisner]

RTC

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/34518.}

[wilsonge]

Thanks!