allow `time` tag and `lang` attr, remove `XPATHS_TO_REMOVE`, add test coverage, get JRuby green

[flavorjones]

Preparing for a larger refactor related to HTML5 parsing support, this PR started as backfilling test coverage for the default safelist.

public API changes

• the time tag is now allowed by default (note that the datetime attribute was already allowed, and that attribute is only valid in a time tag)
• the lang attribute is now allowed by default (note that the xml:lang attribute was already allowed, and that attribute is only valid if there is also a matching lang attribute)
• the Rails::Html::XPATHS_TO_REMOVE constant is removed

Note that time tag and lang attribute are safe and are already allowed by Loofah, DOMPurify, and other common sanitizers.

The XPATHS_TO_REMOVE constant was public, but probably should have been a private constant (an implementation detail) all along. It's possible that removing it might break somebody who's monkeypatching the sanitizer, but really they should be using SafeListSanitizer's allowed_tags and allowed_attributes attrs instead of changing the value of this constant.

test suite changes

Within the test suite, I've also made the following changes:

• avoid using assert_dom_equal which was obfuscating what is being tested
• JRuby tests now pass

[flavorjones]

Actions isn't working well, but I kicked off a manual run of CI on this PR at https://github.com/rails/rails-html-sanitizer/actions/runs/4948930151 which is green.