Allowlist-based HTML and CSS sanitizer
