SECURITY: validate URL added to listings

Ensure listings urls are valid, and not "javascript:", etc.

Use Html::element instead of rawElement when displaying name.

Bug: T77624
Change-Id: If23d7dfa8ef04cd5fd00823dfa55b017cedd5336