MathML support in the HTML Sanitizer API

See https://wicg.github.io/sanitizer-api/

Some work has been done to hande mathml/svg namespaces but the spec should likely specify a default safelist, see https://github.com/WICG/sanitizer-api/issues/103#issuecomment-2009143357 (IIRC, the API allows web dev to accept more element/attributes that are not in the safelist, though)

So this issue is about discussing what we want to suggest as a default safelist for MathML.

In another issue, I had commented to try and follow MathML Core as much as possible as that's what browsers are expected to implement: https://github.com/WICG/sanitizer-api/issues/167#issuecomment-1415147702

Some more comments:

Firefox has some safe list already but I guess it is not very strict, for example it still allows XLink href or content mathml markup. The bug is https://bugzilla.mozilla.org/show_bug.cgi?id=1787594

For Chromium, I don't remember without checking more. But probably it does not include more than what is in MathML Core, since we never implemented more.

I'm not sure if the sanitzer api is actually being implemented in webkit.

Start by reading the Sanitizer API specification and the linked discussions in issues 103 and 167, then compare the MathML Core elements and attributes with existing browser safelists, including Firefox's bug 1787594. Done means reaching agreement on a default MathML safelist and specifying it clearly in the Sanitizer API proposal.