Set sanitize marked option to true by default?

[Many issues](https://github.com/sparksuite/simplemde-markdown-editor/issues?utf8=%E2%9C%93&q=is%3Aissue+is%3Aopen+xss) on simple-mde was about an XSS vulnerability, allowing the user to execute JS code in the preview.

While the *never trust the user* is a common practice in web development, I think that we should avoid this and set the [marked sanitize option](https://marked.js.org/#/USING_ADVANCED.md#options) to true by default.

I don't really find use-cases where injecting JS in a markdown viewer is useful.

Note that of course we can easily set this option with `renderingConfig` like below, this issue is just about choosing the default behavior.

```js
new EasyMDE({
element: ...,
renderingConfig: {
markedOptions: {
sanitize: true
}
}
});
```

### I'm submitting a...
- [x] Bug report
- [x] Feature request

(well, not sure here...)

### Reproduction steps

Just type this in the text area:

Then activate the preview and click on the text.

### Version information

Any browser, any version

Locate the EasyMDE rendering configuration and the marked integration, starting with the renderingConfig and markedOptions references in the issue. Reproduce the supplied onclick example in preview mode, then verify that the default behavior no longer executes it while the documented configuration remains coherent.

Written by the indexing model from the issue text.