replace bleach by lxml

[AndreasDickow]

No description provided.

[AndreasDickow]

The Django Bleach project is deprecated so we replaced it by lxml

[parisk]

Hi @AndreasDickow, thanks a lot for your contribution, but we cannot accept it currently. There are a few reasons behind this.

First, we want to take our time and make an informed decision moving forward, as mentioned in #36 (comment). There is no time pressure at the moment.

Second, lxml has dropped mainstream support for clean_html (lxml/lxml#384), as it's not suitable for security-sensitive software like Django Prose.

Last, it looks like html5lib is back on development (html5lib/html5lib-python#560), which was the main reason behind the deprecation of Bleach (mozilla/bleach#698). This removes even more pressure from our shoulders to make an urgent decision.

Given the comments above, I believe the most probable scenario is to move on with nh3 in the next major release of Django Prose, unless Bleach gets back in development, so we do not need to do an update at all.

Thanks a lot for putting the time to contribute this PR! The discussion for the potential next security library for Django Prose is #38. We would love to get your input and suggestions there.