Xss::filter() now supports restricting allowed attributes

The Xss::filter() method now allows restricting allowed attributes.

Previously it was only possible to restrict allowed tags but not attributes, the only removed attributes were known dangerous attributes.
It is now possible to pass a list of allowed attributes:

Xss::filter($userInput, [
  // Allow any attribute for this tag (except dangerous attributes).
  'b', 
  // Allow only specific attributes, other attributes will be removed.
  'a' => ['href'], 
]);

It is still possible to use the method without specifying allowed attributes:

Xss::filter($userInput, ['a', 'b', 'span']);