MDL-78714 editor_tiny: Disable HTML Sanitisation in TinyMCE

This is in keeping with other Editors such as Atto and resolves an issue
where DOM Purification incorrectly identifies HTML-like string content
as an HTML tag with a JS variable.

Moodle already performs XSS sanitisation using HTML Purifier in PHP.

lib/editor/tiny/amd/src/editor.js

@@ -241,8 +241,17 @@ const getStandardConfig = (target, tinyMCE, options, plugins) => {
         // eslint-disable-next-line camelcase
         a11y_advanced_options: true,
 
+        // Ensure that scripts are recognized as valid elements.
+        // eslint-disable-next-line camelcase
         extended_valid_elements: 'script[*]',
 
+        // Disable XSS Sanitisation.
+        // We do this in PHP.
+        // https://www.tiny.cloud/docs/tinymce/6/security/#turning-dompurify-off
+        // Note: This feature has been backported from TinyMCE 6.4.0.
+        // eslint-disable-next-line camelcase
+        xss_sanitization: false,
+
         // Disable quickbars entirely.
         // The UI is not ideal and we'll wait for it to improve in future before we enable it in Moodle.
         // eslint-disable-next-line camelcase