v0.142.1 — Hotfix: chat messages are sanitised

A security hotfix.

• [x] A chat message can no longer run script in other people's browsers. The chat drew a message's stored HTML as it was, so markup posted straight to the API (an <img onerror>, a javascript: link) ran for everyone who opened the channel. The text of every message, old and new, now goes through DOMPurify before it is drawn. What chat itself produces stays: formatting, the spell card's link, wiki links and inline styles. Scripts, event handlers, frames, forms and embedded media are removed, and a link keeps its address only for http(s) and the site's own paths. A link that opens a new tab never gets access to the page that opened it.