[Security] Bump rails-html-sanitizer from 1.0.3 to 1.0.4

[dependabot-preview]

Bumps rails-html-sanitizer from 1.0.3 to 1.0.4. This update includes security fixes.

Vulnerabilities fixed

XSS vulnerability in rails-html-sanitizer
There is a possible XSS vulnerability in rails-html-sanitizer. The gem allows
non-whitelisted attributes to be present in sanitized output when input with
specially-crafted HTML fragments, and these attributes can lead to an XSS attack
on target applications.

This issue is similar to CVE-2018-8048 in Loofah.

Patched versions: [">= 1.0.4"]
Unaffected versions: []

Release notes

Sourced from rails-html-sanitizer's releases.

v1.0.4

• Fix CVE-2018-3741.

Changelog

Sourced from rails-html-sanitizer's changelog.

1.0.1

• Added support for Rails 4.2.0.beta2 and above

1.0.0

• First release.

Commits

• 53bf066 Prepare to 1.0.4 release
• f3ba1a8 Make sure we address CVE-2018-8048
• 7aea595 Remove rbx since it doesn't seem to install.
• 9057f42 Merge pull request #66 from fschwahn/improve-tests
• 2a2a715 Fix deprecation warning from Minitest
• 2e8a706 Make tests pass again with recent nokogiri versions
• 267b121 Rename test to better reflect what is actually tested
• 663bf35 typos
• 362f72d We're still testing against ruby 1.9 and 2.0 that aren't supported by nokogir...
• 1f8b16f activesupport 5 doesn't support ruby < 2.2.2 that are still tested in this repo
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot ignore this [minor|major] version will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use [this|these] label[s] will set the current labels as the default for future PRs for this repo and language

Additionally, you can set the following in your Dependabot dashboard:

• Update frequency (including time of day and day of week)
• Automerge options (never/patch/minor, and dev/runtime dependencies)
• Out-of-range updates (receive only lockfile updates, if desired)

Finally, you can contact us by mentioning @dependabot.