Strip away class attributes from sanitized outputs

There's a lot of shenanigans that are possible when you can apply
arbitrary classes to the rendered output.

config/initializers/sanitize.rb

@@ -4,6 +4,7 @@ Sanitize::Config::OSM = Sanitize::Config.merge(
   :add_attributes => { "a" => { "rel" => "nofollow noopener noreferrer" } },
   :remove_contents => %w[script style],
   :transformers => lambda do |env|
+    env[:node].remove_class
     env[:node].add_class("table table-sm w-auto") if env[:node_name] == "table"
   end
 )