`bleach` dependency has been unmaintained since 2025-06-05

Synapse relies on the bleach dependency to sanitise HTML for any email we send out:

https://github.com/element-hq/synapse/blob/5edcb0f54209b467af675931418aec2f0f1eec2d/synapse/push/mailer.py#L956-L990

It has been [marked as unmaintained](https://github.com/mozilla/bleach/issues/698) since 2025-06-05. We should find an alternative library to sanitise our HTML (and to double-check that what we're doing here is actually making a difference).

There are not currently any reported vulnerabilities with the library (v6.4.0 last month fixed three), but it's only a matter of time...

Start with synapse/push/mailer.py lines 956-990 to understand how bleach currently sanitises HTML sent by email. Investigate maintained alternatives and verify whether the existing sanitisation changes the generated email content; done means selecting a suitable replacement and confirming the email sanitisation remains effective.

Written by the indexing model from the issue text.