Disable XSS filter in flow step description markdown

[awarecan]

XSS filter will filter out data:image in <image> src attribute. Disable the XSS filter allow us to use embedded image in description placeholder. Since we are fully control the step description placeholder, the XSS will not be the concern.

See: home-assistant/core#16129 (comment)

[balloob]

Actually, I had a change of mind. It's too easy for people to update translations and this could be used as an attack vector.

Looking at the xss lib that we use, I see that we can override what attributes or tags are filtered or replaced using onTagAttr.

We should instead add an option to ha-markdown to whitelist data: in image source

[balloob]

Ah, found even better, we can use this:

<img src='data:image/svg+xml; ... '>

That way we don't base 64 encode. I'll just white list this type.

[balloob]

Was working on something but didn't finish in time. won't have time until later tonight

[awarecan]

This PR has been replaced by #1600.