Re: Fix HTML escaping when rendering README

[Chris Warburton]

Use Pandoc to render to HTML (assuming markdown), then use Bleach to
strip all but a whitelist of HTML elements, attributes and protocols.

This way, elements like '<script>alert("XSS")</script>' get escaped;
attributes like 'onclick="alert(\"XSS\")"' get removed and URLs like
'javascript:alert("XSS")' get removed.