Further XSS fixes in link attrs (#703)

[Crozzers]

Further fixes for #703, specifically the follow up issues raised in this comment: #703 (comment)

Issue 1:
For some reason html encoded colons function as normal colons in hrefs, so javascript:alert() is equal to javascript:alert().

Fixed this by checking for these sequences alongside colons.

Issue 2:
The safe_href regex we use allows for URL domains with ports. This was intended for links like localhost:880/abcdef but could be abused by making the JS look like a domain with a port, like so:

javascript:1/alert();
^ domain  ^ port

Issue 3:
This used some quirky markdown in a image title attr to escape the link. Fixed by hashing the title attr to prevent reprocessing, much like we do with alt=

[JorianWoltjer]

Nice work, unfortunately the fuzzer found another bypass on this new branch 😅

Input:

![](`<A B="
" onerror="alert(origin)">`)

Output:

<p><img src="code&gt;&lt;A B="
" onerror="alert(origin)"&gt;&lt;/code" alt="" /></p>

[Crozzers]

Nice work, unfortunately the fuzzer found another bypass on this new branch 😅

Input:

![](`<A B="
" onerror="alert(origin)">`)

Output:

<p><img src="code&gt;&lt;A B="
" onerror="alert(origin)"&gt;&lt;/code" alt="" /></p>

Managed to fix this. Turns out we were hashing the code and spans, and we were meant to unhash them again in the URL encoding, but the while loop was incorrect, and didn't properly recursively unhash everything.

[JorianWoltjer]

Another bypass 😅

Input:

![x](<"`"![x][id]
[id]: x "<A B="" onerror="alert(origin)">`

Output:

<p>![x](&lt;"`"<img src="x &quot;&lt;A B="" onerror="alert(origin)"&gt;`" alt="x" /></p>

[Crozzers]

Another bypass 😅

Another fix. That one was smuggling the XSS through link definitions, so I've changed the _protect_url function to do all the escaping (unhashing code+html spans, escaping bold/em), and LinkProcessor should run all image and anchor URLs through it

[JorianWoltjer]

Took a few minutes more than usual this time, but fuzzer pulled through again on the latest commit:

Input:

- [x]
   1. - [x]
___
[x](`")}<img src="x`" onerror="alert(origin)">
___

Output:

<ul>
<li>[x]
<ol>
<li><ul>
<li>[x]</li>
</ul></li>

</ol></li>
</ul>

<hr />

[x](`")}<img src="x`" onerror="alert(origin)">

<hr />