Sanitize middleware

[tbranyen]

Based off of: https://wicg.github.io/sanitizer-api/

This could work like:

// sanitize all inputs
use(sanitize());

const unsafeMarkup = '<a onclick="doSomeBadThings()"></a>';
innerHTML(element, unsafeMarkup);
element.querySelector('a').click(); // no bad things happen