✨ feat(clean): report what the sanitizer dropped

[gaborbernat]

A caller tuning a sanitizer policy could see only the cleaned string, never which tags or attributes the policy removed, so narrowing or widening an allowlist meant guessing. bleach, nh3, and html-sanitizer expose no such report; DOMPurify does, through DOMPurify.removed. 🔍

sanitize_report() (and Sanitizer.sanitize_report()) return the cleaned HTML paired with one Removed record per dropped element or stripped attribute, in the order the walk reached them: Removed(tag="a", attribute="onclick") for a stripped attribute, Removed(tag="script", attribute=None) for a removed, stripped, or escaped element. Clean input gives an empty list.

The audit runs inside the existing C walk. Each drop appends to a caller-owned list only when reporting is on, so the plain sanitize() path pays one NULL check and nothing else. A sanitize-report benchmark gates the reporting path under CodSpeed.

Closes #528

[codspeed-hq]

Merging this PR will not alter performance

✅ 61 untouched benchmarks
🆕 1 new benchmark
⏩ 18 skipped benchmarks¹

Performance Changes

	Benchmark	BASE	HEAD	Efficiency
🆕	test_feature[sanitize-report-spec]	N/A	15.2 ms	N/A

---

_{Comparing gaborbernat:feat/528-sanitize-audit (6c680ad) with main (4f76978)}

Footnotes

1. 18 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩