Add URL sanitation to avoid javascript: links

Summary:
Original code taken from
https://github.com/chjj/marked/commit/904c71b7713979b01d5bc5264c2808c73fef99a7

Test plan:
Added this to https://github.com/Khan/perseus and made an image, a link,
an autolink, and a url (technically, the regex recongizing this already
seems to ignore javascript: links, but sanitizing everything seems to
make more sense than doing it only when obviously necessary), all
starting with javascript:, and made sure that none of them executed the
javascript.