Updates to sanitizer; all-in with inline HTML

Updates to sanitizer; all-in with inline HTML

 - Remove iframe and "static hosting" as a strategy for showing a note.
   Only show inline HTML.
 - Add a "format preserving" sanitizer that does XSS filtering and prep
   for inline HTML, but doesn't remove visual markup.
 - Remove javascript pertinent to PDF viewing. Handle zoom buttons using
   CSS transforms on the HTML container.
 - Add notion of "editability" for Notes.  Notes will save with an
   "editable" sanitizer that strips to markdown-caliber HTML which the
   client side WYSIWYG can handle if the note is an editable type, and
   renders with a "format preserving" sanitizer that uses complex ugly
   junk as the HTML if it's not meant to be edited.
 - Add and improve tests for this stuff.