fix($compile): sanitize values bound to img[src]

Ref: 9532234bf1c408af9a6fd2c4743fdb585b920531

BREAKING CHANGE: img[src] URLs are now sanitized using the same whitelist
    as a[href] URLs.  The most obvious impact is if you were using data:
    URIs.  data: URIs will be whitelisted for img[src] in a future
    commit.