Another safe mode XSS

[Arc-blroth]

Running

<img onerror=alert("hi")<a> src=a

through markdown2 with --safe replace results in an XSS:

<p><img onerror=alert("hi")[HTML_REMOVED] src=a</p>

From what I could tell, this is because:

• _hash_html_spans assumes the first token is never html (is_html_markup = False) and that succeeding tokens alternate between normal text and html markup (is_html_markup = not is_html_markup)
• thus, the entire first token <img onerror=alert("hi") does not get run through sanitize_html
• instead, that token gets run through _encode_incomplete_tags
• but since that token fails the regex _incomplete_tags_re it also doesn't get < escaped with <

markdown2.__version__ == '2.4.13'