Expose Trix.config.dompurify to allow users to configure DOMPurify.
Additionally avoid stripping data-trix-* attributes.

Make DOMPurify configurable

If SAFE_FOR_XML is true all comments are removed from attachments.

See: #1213

Allow comments in attachments

node-sass is deprecated and doesn't work on newer platforms (e.g. arm64)

Switch from node-sass to sass

Use `compile` instead the deprecated `render` method.
No changes to the generated `.css`.

See https://sass-lang.com/documentation/js-api/functions/render/

#1215 indirectly removed the `--watch` mode, by switching SCSS compilation
to a node.js file. This was required because the `sass` CLI doesn't support the `--function` for custom functions.
Now reintroduce it back using `chokidar`. This also fixes `yarn start` command.

Reintroduce yarn build --watch

Prevously, was possible to trigger XSS setting as link an URL like
`javascript:alert('XSS')`.
Fix it via a custom HTML input validation pattern to block both
`javascript:` and `data:` URLs.

This should any cover edge case not covered by the Regexp.

Fix XSS via `javascript:` url in a link

- use `isSafeAttribute` instead of `safeAttribute`
- Extract conditional to an outer if
- Add parenthesys for clarity

Refactor link XSS patch