fix(sanitizeUri): Allow object URLs for <img> src

Closes #6581