feat(): whitelist blob urls for sanitization of data-bound image urls

Closes #4623