Bug 1198433

Technical considerations:

* We want to be able to add a preview feature, for which a client-side JavaScript CommonMark renderer would be very helpful.  Plus there don't seem to be any complete CommonMark renderers for Java yet.
* We need to sanitise user input on the About Project page, to protect against XSS.  This is probably not necessary for the Home page, which is only editable by admin users.  Unfortunately, the JavaScript sanitisers seem to be pretty limited in their options, so it would be better to use the OWASP sanitiser we use for email.
* In order to achieve both of the above, I plan to run a JavaScript renderer on the server side, using Rhino (and perhaps Nashorn in future), and then run the generated HTML through OWASP's sanitiser.

See also the following Seam Text bugs, which should be eliminated by this feature:

* bug 1065234
* bug 1056296
* bug 1056301

Pull request: https://github.com/zanata/zanata-server/pull/732

A note on the testing and on the conversion approach:

I have a test (not checked in) which I used to run the conversion method against every bit of Seam Text I could find in all the production databases I could find, comparing the original rendered Seam Text and the rendered CommonMark.  I fixed some bugs in my conversion, massaged some of the data (in production) and told it to skip over some others which looked like plain old HTML (not Seam Text).

I have also run Zanata server (and thus the Liquibase migration) against copies of all the production databases.  As expected from the previous test, there were a number of warnings for invalid Seam Text, all of which probably cause rendering failures in production, like bug 1065234.

In the cases I looked at, the result looks better now that it is rendered as CommonMark/HTML, since most of these cases were actually HTML.  There was one case which was mostly rendered as HTML source in monospace, but it previously didn't render at all, so I still consider it an improvement.


Note that some valid Seam Text (ie with Seam Text markup inside HTML tags like <p>) may be transliterated to similar CommonMark, but because CommonMark doesn't process CommonMark inside HTML tags, it will be rendered a little differently.  

A common case is underscores in URLs inside HTML, which were always badly handled in Seam Text, especially if there was an odd number of underscores.  In cases like this, the converted keeps the underscores as underscores, rather than converting to <u></u>.  This will probably fix a few URLs which were broken by Seam!

A slightly worse case is emphasised text (using * markup or similar) inside HTML, which will be replaced by the CommonMark equivalent markup, but rendered as ASCII (and still quite readable) unless someone removes the surrounding HTML in the editor.

VERIFIED with Zanata 3.7.0-SNAPSHOT (git-jenkins-zanata-server-github-pull-requests-3566)

FYI: Upgrade commonmark.js to 0.19.0
https://github.com/zanata/zanata-server/pull/840