Fix sanitized HTML leaking into header ids in safe mode

[LuisFigueroaG]

With safe_mode and the header-ids extra, any inline HTML in a header ends up in the generated id. The id is built while the HTML is still hashed, so the hash keys survive slugifying and are later replaced with the sanitized HTML. Since sanitizing doesn't escape quotes, a header like # Hi <b x="a" onmouseover="alert(1)">x</b> in escape mode produces <h1 id="hi-&lt;b x="a" onmouseover="alert(1)"&gt;...">, which closes the id early and injects an event handler.

This unhashes the HTML spans before generating the id, so the id comes out the same as without safe mode (hello-bworldb for # Hello <b>world</b>). In replace mode the placeholder is slugified as well instead of leaving [HTML_REMOVED] in the id.

Added test cases for both escape and replace modes. This also covers the safe mode case mentioned in #649.

[nicholasserra]

Thanks!