chore: cherry-pick 3abc372c9c00 from chromium

[nornagon]

Apply markup sanitizer in CompositeEditCommand::MoveParagraphs()

CompositeEditCommand::MoveParagraphs() serailizes part of the DOM and
then re-parse it and insert it at some other place of the document. This
is essentially a copy-and-paste, and can be exploited in the same way
how copy-and-paste is exploited. So we should also sanitize markup in
the function.

(cherry picked from commit c529cbcc1bb0f72af944c30f03c2b3b435317bc7)

Bug: 1141350
Change-Id: I25c1dfc61c20b9134b23e057c5a3a0f56c190b5c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2500633
Commit-Queue: Yoshifumi Inoue yosin@chromium.org
Reviewed-by: Yoshifumi Inoue yosin@chromium.org
Cr-Original-Commit-Position: refs/heads/master@{#821098}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2518088
Reviewed-by: Xiaocheng Hu xiaochengh@chromium.org
Commit-Queue: Xiaocheng Hu xiaochengh@chromium.org
Cr-Commit-Position: refs/branch-heads/4280@{#1099}
Cr-Branched-From: ea420fb963f9658c9969b6513c56b8f47efa1a2a-refs/heads/master@{#812852}

Notes: Security: backported fix for 1141350.

[release-clerk]

Release Notes Persisted

Security: backported fix for 1141350.