Rework XSS filtering implementation for more use cases

I found Drupal\editor\EditorXssFilter\Standard::filterXss() and was hoping that would solve this use case, but unfortunately it does not.

I'm reluctant to roll our own XSS filtering for this use case, in part because it still wouldn't be bulletproof. For example:

Search expression: <(em)>.*(bed).*<\/em>
Replacement: <$1$2>
Content: <em>go to bed</em>
Result: <embed>

I think we have two main options:

1. Keep XSS filtering and document this as a known limitation (we could also switch filtering to use Standard::filterXss())
2. Remove XSS filtering to allow for more use cases and acknowledge that there are many ways that security can go wrong when it comes to configuring text filters and formats beyond the scope of this module.

I need to examine the bigger picture more to see if there are other protections/mitigations that might allow us to justify removing XSS filtering the replacement text.