Drop `bleach` as dependency. `bleach` is now archived.

[kurtqq]

This topic has been discussed many times over the several years
#1941
#1952
#2130

Now, taking action is unavoidable.
bleach announced end of life. Maintainer posted https://bluesock.org/~willkg/blog/dev/bleach_6_4_0_final_release.html which explains that bleach dependencies post a security risk that can no longer mitigate and the project is shut down.

Now, it is no longer the case of just a deprecation notice it's a case where action must be taken.

[kurtqq]

cc @minrk @krassowski @bollwyvl

[ppham-nv]

It was suggested that justhtml could be a potential replacement per https://bluesock.org/~willkg/blog/dev/bleach_6_4_0_final_release.html

[xusheng-tw]

It was suggested that justhtml could be a potential replacement per https://bluesock.org/~willkg/blog/dev/bleach_6_4_0_final_release.html

https://github.com/messense/nh3 has came up as replacement from a number of repo. we are replacing bleach with nh3 as well. fairly straight forward replacement