Token API / hook_tokens() changed to be more secure

As of #2567257: hook_tokens() $sanitize option incompatible with Html sanitisation requirements token API got a couple of changes:

• hook_tokens() implementors are no longer responsible for "sanitization". If the token value is plain text, just return the string.
  If the token value is supposed to be HTML a MarkupInterface object should be returned, for example by using $renderer->renderPlain(['#markup' => $string]);. There's an issue to improve the DX for this usage (see #2577827: Add a XssFilteredMarkup).
  Token::replace() escapes automatically, so API users don't need to take care about that.
• $options['sanitize'] is removed completely from hook_tokens().
• $options['sanitize'] is removed completely from Token::replace().
• Token::replace() now calls Html::escape() on each token value, unless it is an HTML markup string (i.e. an instance of MarkupInterface).
• The result of Token::replace() is now HTML markup as a string. If the caller wants to use it outside of HTML, it needs to be converted to the appropriate format, for instance to plain text via PlainTextOutput::renderFromHtml().