Fix: add filterXSSWithResult() to track removed tags and attributes (fixes #284)

[Joya-Biswas]

Fixes #284

Problem
When filterXSS() sanitizes HTML, it returns only the clean output string. There is no built-in way to know which tags or attributes were removed during sanitization. Users who need this information — for example, to display validation errors to their users — must manually wire up onIgnoreTag and onIgnoreTagAttr callbacks every single time they use the library. This is repetitive, easy to get wrong, and not obvious from the documentation.

Solution
This PR adds a new exported function:
filterXSSWithResult(html, options)

It returns an object with two properties:

• html — the sanitized HTML string, identical to what filterXSS() returns
• removed — an array of objects, one for each tag or attribute that was removed

Example:

var xss = require("xss");

var result = xss.filterXSSWithResult(
  '<script>alert("xss")</script><a href="#" onclick="evil()">click</a>'
);
console.log(result.html);
// &lt;script&gt;alert("xss")&lt;/script&gt;<a href="#">click</a>
console.log(result.removed);
// [
//   { type: 'tag',  tag: 'script', html: '<script>',   isClosing: false },
//   { type: 'tag',  tag: 'script', html: '</script>',  isClosing: true  },
//   { type: 'attr', tag: 'a',      attr: 'onclick',    value: 'evil()' }
// ]

Notes

• Fully backwards compatible — existing filterXSS() usage is completely unchanged
• If the caller already provides onIgnoreTag or onIgnoreTagAttr in their options, those callbacks still fire correctly
• Clean HTML with nothing to remove returns an empty removed array []
• The change is confined to index.js — no changes to core filtering logic

A note on process

I'm a beginner contributor and this is one of my first open source contributions.
I used Claude as a learning assistant to help me understand
the existing codebase and the JavaScript concepts involved. All decisions about
what to change, where to change it, and how to verify it were made by me and
tested locally before submitting.