Add comment, test to unescapeHTML (#7949)

app/javascript/mastodon/utils/html.js

@@ -1,3 +1,4 @@
+// NB: This function can still return unsafe HTML
 export const unescapeHTML = (html) => {
   const wrapper = document.createElement('div');
   wrapper.innerHTML = html.replace(/<br\s*\/?>/g, '\n').replace(/<\/p><p>/g, '\n\n').replace(/<[^>]*>/g, '');