[BUGFIX stable] Sanitize Href attribute usage.
[BUGFIX stable] Expand sanitization to img and link tags
[BUGFIX stable] Add escaping to iframe.
Merge pull request #10028 from rwjblue/href-xss-1-9

[BUGFIX release] Sanitize Attributes for a, img, link, and iframe tags.