Update safe extension to remove event listeners in MathML input

[dpvc]

This PR adds support for filtering out event listeners like onclick from MathML input. By default these are now filtered out. This behavior is controlled by on* entry in the filterAttributes map. One could use

MathJax = {
  loader: {load: ['ui/safe']},
  startup: {
    ready() {
      MathJax.startup.defaultReady();
      MathJax.startup.document.safe.filterAttributes.delete('on*');
    }
  }
}

to remove this filter. There is no configuration parameter for this, as there are completely unsafe, so removing this filter should be hard to do.

The PR also fixes the alignment of @returns jsDoc declarations.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 86.92%. Comparing base (6c2be35) to head (7f3916c).
⚠️ Report is 21 commits behind head on develop.

Additional details and impacted files

@@             Coverage Diff             @@
##           develop    #1548      +/-   ##
===========================================
- Coverage    86.92%   86.92%   -0.01%     
===========================================
  Files          390      390              
  Lines        87853    87857       +4     
  Branches      4984     4983       -1     
===========================================
- Hits         76370    76368       -2     
- Misses       11464    11470       +6     
  Partials        19       19              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[zorkow]

lgtm.
One typo, but I might be wrong.