sanitize urls: svg/xlink href, formaction, and data: on iframe/object

[rootvector2]

Consolidates the open URL-sanitizer fixes into one PR (per review). Each change closes a way an attacker-controlled value can reach a dangerous protocol that the sanitizer currently misses.

• SVG anchors (case sensitivity). checkURI/checkDataURI matched element.tagName against the uppercase badTags list, but SVG tagNames come through lowercase (a), so <a href={{value}}> inside an <svg> skipped the javascript:/vbscript: check. Normalization now happens inside checkURI/checkDataURI so it is single-sourced. Also added xlink:href to the attribute list, since that is the SVG href alias and was not covered at all.
• formaction (sanitize javascript: urls in formaction on button and input #21438). button[formaction] and input[formaction] submit to their URL, so a javascript: value there executes. Added BUTTON/INPUT to badTags and formaction to the attribute list.
• data: on iframe[src] and object[data] (mark data: urls as unsafe on iframe[src] and object[data] #21441). A data: URL in these loads as a nested document and can run script. Added a data:-protocol check for iframe/object.
• tab/newline stripping (strip ascii tab/newline from urls before protocol check #21433). Browsers strip ASCII tab/newline/CR from a url before navigating, so java\nscript: runs as javascript:. The fastboot url.parse path kept those chars and reported a null protocol, slipping past the check. Strip them there to match the WHATWG URL parser used on the browser path.

Tests added for each case except the tab/newline strip, which only runs on the fastboot url.parse path (the browser URL parser already strips those chars, so no integration path exercises it).

Reproductions on limber for each case are in the comment below.

[rootvector2]

Reproductions on limber, one per case. Each binds the attacker value to the attribute so it goes through the sanitizer. On a released Glimmer the dangerous protocol survives in the DOM; with this PR it comes back as unsafe:.

• svg a[href] (javascript:): https://limber.glimdown.com/edit?format=gjs&c=MYewdgzgLgBArgJwDYwLwwOQCsCGA3HCYBASwAcoAuHJAUwSgAoATEYOAW1rCgDpWOOEmACUGANwAoSQB4otDmSQ55APkkwYMiHgDmMAO4lmUABaoARAEYAbAAYLMU7RK7TUSwBYH6zZpk4Tgi0AGaoAN7hiEgAvjG+fv7yAB6wyZZWDjAAnpYATJ4WqsBIJMAA1jBcMgD0KVAJ-jU4CbU6uuq18orKapJAA
• svg a[xlink:href] (javascript:): https://limber.glimdown.com/edit?format=gjs&c=MYewdgzgLgBArgJwDYwLwwOQCsCGA3HCYBASwAcoAuHJAUwSgAoATEYOAW1rCgDpWOOEmACUGANwAoSQB4otDmSQ55APkkwYMiHgDmMAO4lmUABaoARAEYAbAAYLMU7RK7TUSwBYH6zZpk4MAAeSMIA1pSmCLQAZqgA3vGISAC+Kb5+-vJBsEGWVg4wAJ6WAEyeFqrAocBhMFwyAPTZUBn+jTgZTTq66k3yispqkkA
• iframe[src] (data:): https://limber.glimdown.com/edit?format=gjs&c=MYewdgzgLgBArgJwDYwLwwOQBMCGUcBcUApgB5QD0AFlALZIA0APBMAgJYAOUAfDksQRQAFFhDA4tYmCgA6MbRzswASiYAdCqw7ceGANwAoQ0xK1OSPMR6GYMJuwBmCHFJgQEwVAG9viJAC+ATxMFE4uUjahZhZWNkA
• object[data] (data:): https://limber.glimdown.com/edit?format=gjs&c=MYewdgzgLgBArgJwDYwLwwOQBMCGUcBcUApgB5QD0AFlALZIA0APBMAgJYAOUAfDksQRQAFFhDA4tYmCgA6MbRzswASiYAdCqw7ceGANwAoQ0xK1OSPMR6GYMJiABGAK2LBYufKgDe3xEgBfAJ4mCidXdxtQswsrGyA
• button[formaction] / input[formaction] (javascript:): https://limber.glimdown.com/edit?format=gjs&c=MYewdgzgLgBArgJwDYwLwwOQCsCGA3HCYBASwAcoAuHJAUwSgAoATEYOAW1rCgDpWOOEmACUGANwAoSQB4otDmSQ55APkkwYMgGYgEHdZs0yARnChRwMXfpzAoJcKgDezxEgC+H1RDgmOJFAyAPRmFuCGRjLCZOYwUACeZLSoAES+-oGp1nqC9o5gLm7IXjAESHAp6X4BsJYg2cGRITYGssHyispqkkA

The tab/newline strip from #21433 doesn't have a browser repro - that path only runs under fastboot's url.parse. In the browser the WHATWG URL parser already strips \t\n\r, so java\nscript: is caught there regardless.

[rootvector2]

Folded the AREA case in here too (it's the same badTags selection, an <area href> in an image map navigates on click just like an <a>). Repro, same shape as the others:

• area[href] (javascript:): https://limber.glimdown.com/edit?format=gjs&c=MYewdgzgLgBArgJwDYwLwwOQCsCGA3HCYBASwAcoAuHJAUwSgAoATEYOAW1rCgDpWOOEmACUGANwAoSQB4otDmSQ55APkkwYMkhwDmGzTAgJgqAEQALKFDIRKAentKcwWhZBJmvUPYCMANgAGAA8AFkCzA00AdxJmKAtzAIiomAtaEl0rc3DIw3gIBRwycwBiDjzDGihzHRxdWhhBMkr7dU0ZZpgwHC5zCvbDGRwEWhwjC2Lac1HgKDMYUBAEZghzQIAaTeSN3LTRgDNUAG9jxCQAXwuYavNgJBJgAGsm2gW2gxl7ZvUv+UVlGpJEA

Click the box and on a released Glimmer it fires; with this PR the href comes back as unsafe:.

[johanrd]

nitpick for the comment wording: SVG tagNames are case-preserved (e.g. linearGradient, clipPath, foreignObject),

– just comment wording, does not affect logic/correctness, as a just happens to be lowercase, and a is the only SVG element in badTags

[rootvector2]

good catch, reworded it. a is the only one in the list and it happens to be lowercase, but the comment shouldn't imply that's true of svg tagNames in general.