We've been using an older version of Bleach (3.x) for some time now.

This is pretty out of date, and there's no reason not to move to 6.x.
This change moves us onto 6.0.x, which is fully compatible with the

exception that it's more strict about a parameter that needed to be a

set and not a list.
Bleach 6 is compatible with Python >= 3.7, so it's safe as a dependency

for Review Board 5.

All unit tests passed.
Tried various HTML snippets and attacks, and didn't hit any issues.