XSS sniff: Remove some *_url functions from the auto-escaped function list

These aren’t auto-escaped. See
WordPress-Coding-Standards/WordPress-Coding-Standards#147
XSS Sniff: remove unsanitary functions from the auto-escaped list

Fixes WordPress-Coding-Standards/WordPress-Coding-Standards#147
Merge pull request #149 from JDGrimes/auto-escaped-functions

Remove (non) auto escaped functions from the XSS sniff