Add further commit for ruby-loofah

The commit is not strictly needed to fix CVE-2018-8048 but it makes
possible for other gems (like rails-html-sanitizer) to use the logic
directly for their own attribute scrubbers.