Allow SVG elements in markdown

[jameshadfield]

This modifies our settings for DOMpurify to allow SVG tags (and tags used within SVG).

You can see a test narrative here. This will be available vie the review app also.

For this to work we removed the ALLOWED_ATTR sanitizer config settings, but I note that the docs state "The included default configuration values are pretty good already". An alternate approach would be to also remove the ALLOWED_TAGS setting as the default allows SVG.

[joverlee521]

I'm definitely not an expert on script injection and not sure what "default configuration values are pretty good already" means.

When I made these initial changes to the footer, @tsibley had commented that allowing style will allow clickjacking. Perhaps we want to add {FORBID_ATTR: ['style']}?

[tsibley]

I don't think it's wise to remove our ALLOWED_ATTR or switch to only FORBID_ATTR. DOMPurify's goals are very focused on XSS and not other issues arising from embedding untrusted content and its defaults for allowed content reflect this.

[jameshadfield]

I don't think it's wise to remove our ALLOWED_ATTR or switch to only FORBID_ATTR

I have no problem keeping ALLOWED_ATTR if it's possible to find a list of values which allow SVG rendering.