Replace `bleach` with `nh3`

[savchenko]

Latter is supported and in active development while former is apparently not. Also, to quote the nh3 author:

A quick benchmark showing that nh3 is about 20 times faster than the deprecated bleach package.

[savchenko]

@jwag956 , please feel free to ping me if you'd like some help with this one.

[jwag956]

Reading all the info on bleach and various alternatives (including at least one note that trying nh3 caused issues) - I am not inclined to rush on this. Bleach is supported - just not getting new features.

As for speed - in this context - not an issue - we are simply using this on the username form input value - which has a maximum size of 64 bytes (default).

I am keeping this open so others can find this discussion - if in fact bleach (and html5lib) are truly deprecated, we can look into the various other packages.