Sanitize

Filter all suspicious content from
```
<tc:textarea>
```
and
```
<tc:out escape="false">
```
See OWASP Java HTML Sanitizer Project
The filter can be configured the tobago-config.xml file with the <sanitizer> tag.

Example for an configuration which is active by default:

<sanitizer>
  <sanitizer-class>org.apache.myfaces.tobago.sanitizer.JsoupSanitizer</sanitizer-class>
  <properties>
    <!-- Use one of: basic, basicWithImages, relaxed, simpleText or none -->
    <entry key="safelist">relaxed</entry>
  </properties>
</sanitizer>