Sanitizer: hard deprecate passing $options to escapeIdReferenceList()