Fix #374 and #409 - Prevent XSS and add Markdown support

[aerovulpe]

Fixes the XSS vulnerability by handling three different formatting modes we support separately.

A new helper parse-message.js was added to utils that uses the popular battle-tested unified library with plugins for HTML and Markdown to sanitize and translate Markdown to HTML, adding full Markdown support.

The default formatting mode no longer uses v-html to dynamically add arbitrary HTML to the DOM, however, users can still customize messages with dynamic HTML, opting in using text-formatting='{ "html": true }'. The injected HTML is first sanitized to remove dangerous elements. text-formatting='{ "markdown": true }' was similarly added to allow users to use CommonMark-compliant Markdown.

The default formatting functions in FormatMessage.vue were refactored into parse-message.js to consolidate the parsing logic.

Note these changes also set the groundwork to address #409.

What kind of change does this PR introduce? (check at least one)

• Bugfix
• Feature
• Code style update
• Refactor
• Build-related changes
• Other, please describe:

Does this PR introduce a breaking change? (check one)

• Yes
• No

If yes, please describe the impact and migration path for existing applications:

The PR fulfills these requirements:

• When resolving a specific issue, it's referenced in the PR's title (e.g. fix #xxx[,#xxx], where "xxx" is the issue number)
• All tests are passing

[antoine92190]

Note: I implemented prettier in the project, if you can please use it so we keep the code format consistent

[aerovulpe]

Note: I implemented prettier in the project, if you can please use it so we keep the code format consistent

Hey @antoine92190, I've run prettier for the files changed in this PR. ✅

[aerovulpe]

Also, happy to discuss the unified dependency and how it could play into Markdown support and #409.

The goal is to simplify format-string.js. Specifically compileToJSON. This method basically compiles Markdown into a JSON AST. We can use remark-parse to parse a richer mdast AST and process that in compileToHTML. This would minimize changes to the styling layer with the benefit of a standardized grammar for Markdown.