Blanket find and replace URI.parse() to Addressable::URI.parse()

- The tests are meant to fail - I'm fixing them in a separate commit
  to avoid quite so many one-line changes.
- If there's a file in here that's not meant to be here, let me know
  and I'll attempt to take it out.
Fix the tests that were failing after d3de9c0e5d

- This makes sure that at least some XSS vulnerabilities are catered
  for, by checking that the path doesn't contain `<script>`.
  `URI.parse` did this for us, but we don't have the luxury using
  `Addressable::URI.parse`, as it is a valid URL according to the RFC
  it uses - see https://github.com/sporkmonger/addressable/issues/141.
- Underscores are also valid according to `Addressable::URI.parse`,
  so change the tests using underscores for invalid data to use curly
  braces for invalid data. Revert the changes in 30b999a that had to
  change underscores to dashes for `URI.parse` to confirm the
  hostnames as valid.
Change the URI validation to not just be "does it start with http://?"

- Remove excluding URIs containing <script> following @rgarner's
  security investigation. This isn't a security concern as we deal
  with this in other places. Remove a test associated with the URI
  parser stating this was an invalid URI.
Change new occurrences of URI.parse to Addressable::URI.parse

- Change the test data to not test on underscores, because they're
  valid, but curly braces.
- URI.parse crept in again from a rebase. :-)
Merge pull request #283 from alphagov/switch_to_addressable_uri_parse

Switch from URI.parse to Addressable::URI.parse