feat: stored HTML keeps link rel and media names are slugged

- the HTML policy keeps rel on a when it holds only nofollow, sponsored
  and ugc tokens (D-83); any other rel value is removed
- classes.MediaFileName slugs uploaded image names (lowercase, Polish
  letters transliterated, hyphens, at most 80 characters, image when
  empty) for the editor upload and POST /media/upload (D-85)
- the editor corpus gains an external link with rel and a decorative
  image, pinned by TestEditorOutputPassesPolicy

classes/format_html.go

@@ -70,6 +70,10 @@ func newHTMLPolicy() *bluemonday.Policy {
 	// TipTap's ordered-list input rule writes start when a list does not
 	// begin at 1.
 	p.AllowAttrs("start").Matching(regexp.MustCompile(`^[0-9]+$`)).OnElements("ol")
+	// The Blog Editor's link form writes rel on external links (Phase 33,
+	// D-83): only the nofollow, sponsored and ugc tokens, space-separated.
+	// Any other rel value is removed.
+	p.AllowAttrs("rel").Matching(regexp.MustCompile(`^(nofollow|sponsored|ugc)( (nofollow|sponsored|ugc))*$`)).OnElements("a")
 	return p
 }