Filter invisible Unicode after HTML entity normalization

FilterInvisibleCharacters previously ran only before FilterHTMLTags,
so numeric HTML entities (e.g. ​ or ​) that bluemonday
decodes into invisible or bidirectional control characters could
survive sanitization untouched. Sanitize now applies the
invisible-character filter both before HTML processing (so raw
invisible characters don't interfere with code-fence parsing) and
again after, so entity-decoded characters cannot escape the policy.

Also expands the removal set to include:
- ARABIC LETTER MARK (U+061C), a directional format character in the
  same family as the already-covered LRM/RLM marks.
- Variation selectors (U+FE00-U+FE0F) and the variation selectors
  supplement (U+E0100-U+E01EF), which can be used to hide payloads
  after emoji or other base characters.

Fixes #3101