[Security] Bump sanitize from 4.6.4 to 5.2.3

Bumps [sanitize](https://github.com/rgrove/sanitize) from 4.6.4 to 5.2.3. **This update includes security fixes.**
- [Release notes](https://github.com/rgrove/sanitize/releases)
- [Changelog](https://github.com/rgrove/sanitize/blob/master/HISTORY.md)
- [Commits](rgrove/sanitize@v4.6.4...v5.2.3)

Signed-off-by: dependabot-preview[bot] <[email protected]>

Gemfile

@@ -28,7 +28,7 @@ gem "jquery-rails", '~> 4.4.0'
 gem 'jquery-ui-rails'
 gem "rubyzip", "~> 2.0.0", :require => "zip"
 gem "nokogiri", ">= 1.8.1"
-gem "sanitize", "~> 4.6.3"
+gem "sanitize", "~> 5.2.3"
 gem "heroku_external_db"
 gem "illyan_client", "~> 2.0"
 gem "rollbar"

Gemfile.lock

@@ -297,8 +297,8 @@ GEM
       racc (~> 1.4)
     nokogiri (1.11.4-java)
       racc (~> 1.4)
-    nokogumbo (1.5.0)
-      nokogiri
+    nokogumbo (2.0.5)
+      nokogiri (~> 1.8, >= 1.8.4)
     orm_adapter (0.5.0)
     pg (0.21.0)
     pry (0.10.1)
@@ -361,10 +361,10 @@ GEM
     rubycas-client (2.3.9)
       activesupport
     rubyzip (2.0.0)
-    sanitize (4.6.4)
+    sanitize (5.2.3)
       crass (~> 1.0.2)
-      nokogiri (>= 1.4.4)
-      nokogumbo (~> 1.4)
+      nokogiri (>= 1.8.0)
+      nokogumbo (~> 2.0)
     sass (3.7.3)
       sass-listen (~> 4.0.0)
     sass-listen (4.0.0)
@@ -467,7 +467,7 @@ DEPENDENCIES
   ruby-graphviz (>= 0.9.2)
   rubypants (>= 0.3.0)!
   rubyzip (~> 2.0.0)
-  sanitize (~> 4.6.3)
+  sanitize (~> 5.2.3)
   sass-rails
   selenium-webdriver
   shoulda-matchers