URL allowlist #19

Description

Currently all URLs are rendered into the output regardless of scheme, including ones that execute.

Reproduction

new Markdown()->parse('[click](javascript:alert(1))')->html;
// <p><a href="javascript:alert(1">click</a>)</p>

Proposal

A single opt-in allowlist (that denies anything not specified) of permitted URL prefixes, applied to both link href and image src (also if tempest/responsive-image is used we need to make sure this applies there as well):

// Current behaviour, no restriction (default).
new Markdown();

// Strictest: https only.
new Markdown(allowedUrlPrefixes: ['https']);

// Allow inline images, but only formats that cannot carry script.
new Markdown(allowedUrlPrefixes: ['https', 'data:image/png', 'data:image/webp']);

allowedUrlPrefixes: [] is just and idea, the final name, place and way to configure this should be all yours to decide.