Allow more safe elements and attributes in the HTML sanitizer

The lists of safe elements and attributes of the secure HTML element sanitizer are based on DOMPurify 2.3.8. Later DOMPurify versions (up to 3.4.17) allow the following additional safe elements and attributes, which the sanitizer should allow too:

• HTML elements: search, slot
• HTML attributes: inert, popover, part, exportparts, wrap
• SVG filter element: feDropShadow
• SVG attributes: amplitude, dominant-baseline, exponent, intercept, mask-type, pointer-events, slope, tablevalues, text-orientation, vector-effect
• MathML element: mprescripts
• MathML attribute: columnspacing
• URL schemes sms: and matrix: in the default list of allowed URLs (only relevant when unknown protocols are disallowed)

The attributes command, commandfor, popovertarget and popovertargetaction, which DOMPurify also allows, are left out: they only have an effect on buttons and inputs, which the sanitizer doesn't allow, and they reference elements of the page by id.