Allow replaceWithChildrenElements together with elements

[evilpie]

For a config like this: {elements: ["em"], replaceWithChildrenElements: ["div"]} and the following HTML <div><em>Apple<em></div>, I would expect the result to be <em>Apple</em>.

However, currently sanitize-core first removes all elements not contained in "elements" (Step 2.4.2.) and then handles "replaceWithChildrenElements" (Step 2.4.3.). I propose we swap these two steps.

(We already disallow having the same element in both elements and replaceWithChildrenElements)