fix: sanitizer does not force `href` attribute for `<a>` tag