Defer shunt_add_new_link filter until after url is sanitized

This isn't strictly a bug in YOURLS, but as a plugin developer I hope you will consider this change.

The `yourls_add_new_link` function calls the `shunt_add_new_link` filter before sanitizing the `$url` parameter, so it's possible for the `http://` scheme to be missing if the user left it out. In my [domainlimit](https://github.com/nicwaller/yourls-domainlimit-plugin/blob/master/domainlimit/plugin.php) plugin, I try to use PHP's `parse_url` function which expects $url to be RFC-compliant, and that fails if the URL is missing an `http://` scheme.

So there are two ways to fix this:
- I could call `yourls_sanitize_url` in my plugin to ensure that a scheme is present, or
- You could defer the shunt filter until after the URL has been sanitized

I think that deferring the call to shunt is cleaner because it avoids repetitive calls to the same function. I look forward to your comments.