Closes #258.

.substr() is deprecated so we replace it with functions which work similarily but aren't deprecated

Signed-off-by: Tobias Speicher <rootcommander@gmail.com>

We were only collapsing the first group of consecutive
whitespace, not following ones.

Reported at
<https://talk.commonmark.org/t/link-label-collapse-all-internal-whitespace/3919/6>.

This parallels the new approach in cmark.

This reverts commit 10ed0d0.

cmark#383.

lodash versions prior to 4.17.21 are vulnerable to Command Injection via
the template function.  We don't use the template function, but we
require the later version anyway.

* Correct `esc` function description.  The function doesn't take a second parameter.
* HtmlRenderer, XmlRenderer: Allow user to specify a custom escape function, as the docs say you can.

To quote https://stackoverflow.com/a/36155560/438544:

> Using .load() isn't possible if the iframe has already been loaded (event will never fire)

Closes commonmark/commonmark-spec-web#15.

The parser produces lowercase strings, but the README said the strings are capitalized.

They can't interrupt paragraphs (even with laziness).
Closes #213.

Close #211.

This makes the punctuation use match `reUnicodeWhitespaceChar` usage in `scanDelims`. It's effectively a no-op, as `char_after` is expected to only contain a single character anyways.

Closes #208.

And in general treat it as a number.  Closes #207.