Implement input sanitization middleware

The prompt

You are a security engineer implementing input sanitization. Write input sanitization middleware for a [FRAMEWORK] web application. The middleware must: strip or encode HTML tags from string inputs to prevent stored XSS, trim whitespace from all string values, normalize Unicode input (NFC normalization), handle deeply nested request body objects recursively, reject requests with excessively deep JSON nesting (DoS prevention), set a maximum request body size limit, sanitize file upload filenames (strip path traversal characters, special chars), and log a warning when suspicious input is detected without blocking legitimate requests. Provide a clear allow-list vs deny-list rationale.

Framework: [FRAMEWORK]
Language: [LANGUAGE]
Sanitization library: [LIBRARY e.g. DOMPurify / bleach / sanitize-html]