fix(html pipe): Sanitize generated markdown to avoid XSS attacks

Properly escape the initial markdown and custom matchers to avoid potential XSS attacks via JS
injection, and also avoid DOM clubbering

fix #253

src/utils/mdast-to-vdom.js

@@ -21,6 +21,7 @@ const { JSDOM } = require('jsdom');
 const HeadingHandler = require('./heading-handler');
 const sanitize = require('./sanitize-hast');
 const HeadingHandler = require('./heading-handler');
+const sanitize = require('./sanitize-hast');
 const image = require('./image-handler');
 const embed = require('./embed-handler');
 const link = require('./link-handler');