Protect against comments in URI schemes (i.e. java<!-- -->script)

It is possible to inject the following:

    <XML ID="xss"><I><B><IMG SRC="javas<!-- -->cript:alert('XSS')"></B></I></XML>
    <SPAN DATASRC="#xss" DATAFLD="B" DATAFORMATAS="HTML"></SPAN>

which (assuming 'i', 'b', 'img' and 'src' are permitted), will yield:

    <I><B><IMG SRC="javas<!-- -->cript:alert('XSS');"></B></I>

While I'm not sure that this is ever interpreted by browsers without an [XML data island](https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#XML_data_island_with_CDATA_obfuscation) (which is stripped by your default tag whitelist), it is still worrying to see the attack payload appear in output, so here's a fix.