Document HTML sanitation policy

[waylan]

This is a first draft of documentation addressing #1479. I don't think I will use this as-is. The same text is reused multiple times, which gets redundant. And we still don't address the API documentation in all the same methods/functions as well as the CLI documentation. I think perhaps a separate page would be more appropriate and then a one sentence warning which points to that page would be appropriate in each relevant location. The separate page could also document the policy for never raising an error on Markdown input and any other relevant security-based issues that might exist.