Add HTMLPurifier after formatters are run.

After a morning of searching, it seems there is no PHP Markdown library
that has built-in XSS/sanitization support. The recommended solution is
to use HTMLPurifier.

This actually works out OK, though, as it’s probably a good idea to
enforce sanitization regardless of which formatters are enabled, and to
not leave them with the responsibility of sanitization (it’s a big
responsibility). Since we cache rendered posts, the slow speed of
HTMLPurifier isn’t a concern.

Note that HTMLPurifier requires a file to be loaded by Composer, but
Studio does not yet support this, so for now I have included it
manually.

composer.json

@@ -14,7 +14,8 @@
         "tobscure/permissible": "dev-master",
         "misd/linkify": "1.1.*",
         "oyejorge/less.php": "dev-master",
-        "intervention/image": "dev-master"
+        "intervention/image": "dev-master",
+        "ezyang/htmlpurifier": "dev-master"
     },
     "require-dev": {
         "fzaninotto/faker": "1.4.0",