Vendored Bleach package is EOL and out of date

Environment information (required)

All released artifacts contain this issue, not specific to a platform or environment.

Issue description

This library relies on bleach as part of its transitive dependencies for HTML sanitizing. bleach is EOL, has been deprecated for the past three years, and is no longer being maintained: https://github.com/mozilla/bleach has the archived status, and some details are included in issue https://github.com/mozilla/bleach/issues/698.

The last release is 6.4.0, updating to that will address some security issues, but there are more recent unpatched issues that also exist with 6.4.0.