webcomponent: sanitize innerHTML

sanitize innerHTML using https://github.com/apostrophecms/sanitize-html or something else

current workaround. import `sanitize-html` and invoke it on every innerHTML

```jsx
import sanitizeHtml from 'sanitize-html';

```

No repository file, test, or entry point is named. Start by locating where webcomponent innerHTML is generated and inspect the existing output tests, then determine the sanitizer and supported behavior before changing it. Done means innerHTML is sanitized by default and the relevant tests cover the resulting output.

Written by the indexing model from the issue text.