feat: Improves SafeMarkdown HTML sanitization (#21895)

UPDATING.md

@@ -22,6 +22,10 @@ under the License.
 This file documents any backwards-incompatible changes in Superset and
 assists people when migrating to a new version.
 
+## Next
+
+- [21895](https://github.com/apache/superset/pull/21895): Markdown components had their security increased by adhering to the same sanitization process enforced by Github. This means that some HTML elements found in markdowns are not allowed anymore due to the security risks they impose. If you're deploying Superset in a trusted environment and wish to use some of the blocked elements, then you can use the HTML_SANITIZATION_SCHEMA_EXTENSIONS configuration to extend the default sanitization schema. There's also the option to disable HTML sanitization using the HTML_SANITIZATION configuration but we do not recommend this approach because of the security risks. Given the provided configurations, we don't view the improved sanitization as a breaking change but as a security patch.
+
 ## 1.5.2
 
 ### Other

superset-frontend/cypress-base/cypress/integration/dashboard/markdown.test.ts

@@ -43,7 +43,7 @@ describe('Dashboard edit markdown', () => {
     cy.get('[data-test="dashboard-markdown-editor"]')
       .should(
         'have.text',
-        '✨Markdown✨Markdown✨MarkdownClick here to edit markdown',
+        '✨Markdown\n✨Markdown\n✨Markdown\n\nClick here to edit markdown',
       )
       .click();