decouple markdown rendering

[roadscape]

MarkdownRenderer, HTML parser, and sanitizer should be bundled into a reusable lib. We also need some basic tests to ensure that rendering is consistent and secure. There are some basic tests as well as an XSS test (janky endpoint) that should be migrated over.