chore(text-editor): proper fix for XSS vulnerability

This is simply #3318 and #3328 squashed into a single commit,
to make it easier to backport.

fix: Lundalogik/crm-feature#4490

Author: adrianschmidt