Footnotes 4.x fable/mythos review

Problem/Motivation

The footnotes 4.x does not have a stable release so is not security covered yet. Get fable/mythos to review.

Fable has identified some edge cases:

1. The parent text format inherits the allowed options from the footnote format. E.g. if parent doesn't have <a> it then makes that available. Low risk given the footnote format has very little options, but worth putting a warning when the icon is added to the toolbar
2. When grouping footnotes together, cache is per URL. Its possible that someone uses footnotes e.g. within a members area where different e.g. blocks are shown per user. Footnote content would then not be unique to users. Warn about this as well when enabling group by
3. Preview character is plain text, it should be escaped. The site admin would have to malicious to do something malicious there, but let's escape it.
4. The search api ignore citations processor classname search should search on a css-friendly classname only
5. Tweak to loading dialog html to use cloning instead to avoid any html mutation

Proposed resolution

Add warnings + hardenings

Remaining tasks

MR

User interface changes

Warnings show up as noted above

API changes

N/A

Data model changes

N/A