Further XSS fixes in link attrs (#703)

[Crozzers]

Further fixes for #703, specifically the follow up issues raised in this comment: #703 (comment)

Issue 1:
For some reason html encoded colons function as normal colons in hrefs, so javascript:alert() is equal to javascript:alert().

Fixed this by checking for these sequences alongside colons.

Issue 2:
The safe_href regex we use allows for URL domains with ports. This was intended for links like localhost:880/abcdef but could be abused by making the JS look like a domain with a port, like so:

javascript:1/alert();
^ domain  ^ port

Issue 3:
This used some quirky markdown in a image title attr to escape the link. Fixed by hashing the title attr to prevent reprocessing, much like we do with alt=