WIP: Separates URL normalization from validation

This is motivated by #6163 and the fact that elgg_normalize_url() struck me as a bad mix of normalization plus validation.

As it is, if the validation failed, we still USE the value, we just stick it after the site URL. Effectively this function is not validating URLs at all, just breaking some of them. It's obviously not a security mechanism because it allows values like `javascript:alert(1)` and dangerous URLs like `php://` which could result in code execution if used in some stream functions.

This PR makes elgg_normalize_url() strictly normalize the URL to the best of its ability (we don't use this function to validate user input anyway), while allowing pass-through of all values beginning with a scheme.