Clean HTML pasted into TinyMCE

A question author copied a passage of text from a running question into the editor. The pasted text included the knockout data-binding code from the default theme, which was passed through untouched and ended up being evaluated, causing an error.

I think it should be possible to have knockout stuff in content areas, because people sometimes do clever stuff with it, but pasting in text shouldn't lead to these kinds of problems.

HTML pasted into the content area editor should be cleaned, removing any attributes that aren't on an allowed list.

Start by tracing how pasted HTML enters the content-area editor and where TinyMCE paste handling is configured. Define or locate the allowed-attribute list, then verify that Knockout data-binding attributes are removed while permitted HTML remains intact; the payload names no specific files or tests.

Written by the indexing model from the issue text.