The Sanitizer API: Safe HTML Injection Without DOMPurify

Every codebase I've worked in has the same line hiding somewhere: an innerHTML assignment with a // TODO: sanitize comment above it that nobody ever got back to. The usual fix is to reach for DOMPurif