Allow the 'class' attribute to pass the sanitizer

[jasongrout]

This allows the 'class' attribute in the default sanitizer.

Fixes #3564

[github-actions]

👈 Launch a binder notebook on branch jasongrout/ipywidgets/allowclass

[vidartf]

Note that the default options for sanitize-html (https://github.com/apostrophecms/sanitize-html#default-options) are quite restrictive. Do we have any sources that support the case that allowing class is safe? Or alternatively, so we have any sources that allowing class is not safe? Do we have any standard to apply when deciding which tags/attributes to allow? While the default behavior is no HTML at all, since we are maintaining our own custom sanitizer allow-list instead of using the default one, we should have some sort of standard for what we consider allowable or not.

[vidartf]

From today's dev meeting, the following points were noted:

• The sanitizer settings are overridden in the lab widget manager, and lab allows the class attribute, so this issue should not have been seen in lab.
• As lab allows the class attribute, and since we allow style, it was generally perceived as less risky.
• We should ideally have a more well defined way of reviewing such changes in the future, and also maybe lab should have a review of its filters.