fix: security issue with sanitizer

[jeremyben]

Hi,
First, thank you for your library as it helped me to quickly ship an app while I was still learning Angular.

Now, you dont want to use the bypassSecurityTrustHtml method to bind some HTML (especially since it's just for <br> tags), as you bypass the built-in Angular sanitizer, and add an avoidable vulnerability to XSS attacks.

You should use the sanitize method with the right security context. Here are the API references :
https://angular.io/api/platform-browser/DomSanitizer#sanitize
https://angular.io/api/core/SecurityContext

Better than that, thanks to Angular, binding HTML with the [innerHtml] property automatically sanitizes the HTML for you with the right security context. So you don't even need to sanitize beforehand.

I still kept the sanitization as a optionnal parameter, if you want to use the transform method elsewhere.

In the end, I strongly recommend you and the users of your library to patch this security issue. 👍