railties: configure sanitizer vendor in 7.1 defaults more robustly

[flavorjones]

Motivation / Background

rails-html-santizer is a dependency of Action View and a transitive dependency of Action Text (via Action Pack), but may not be loaded until after railties sets configuration defaults, meaning that the sanitizer vendor may remain Rails::HTML4 and not be set to Rails::HTML5 as we intend in Rails 7.1.

This change requires rails-html-sanitizer immediately before it's needed, and avoids the possibly-incorrect assumption that Rails::HTML::Sanitizer is already defined.

Closes #51246

If merged, this should be backported to 7-1-stable.

Additional information

Because the buggy behavior is dependent on the order in which libraries are loaded, it's difficult to add to the test suite.

I tested manually using the repro from #51246:

#! /usr/bin/env ruby

require "bundler/inline"

gemfile do
  source "https://rubygems.org"
  gem "rails", path: ".."
end

require "action_controller/railtie"
require "action_view/railtie"
require "minitest/autorun"

class TestApp < Rails::Application
  config.load_defaults 7.1
  config.eager_load = true
end

TestApp.initialize!

class BugTest < Minitest::Test
  def test_sanitizer_vendor
    assert_equal ActionView::Helpers::SanitizeHelper.sanitizer_vendor, Rails::HTML5::Sanitizer
  end
end

Checklist

Before submitting the PR make sure the following are checked:

• This Pull Request is related to one change. Changes that are unrelated should be opened in separate PRs.
• Commit message has a detailed description of what changed and why. If this PR fixes a related issue include it in the commit message. Ex: [Fix #issue-number]
• Tests are added or updated if you fix a bug or add a feature.
• CHANGELOG files are updated for the changed libraries if there is a behavior change or additional feature. Minor bug fixes and documentation changes should not be included.

[flavorjones]

CI failure seems to be a flake and not related to this PR.

[skipkayhil]

CI failure seems to be a flake and not related to this PR.

I went ahead and retried it, all green now ✅

[eileencodes]

I manually backported this in 5305d2d because it didn't apply cleanly.