Prevent XSS attacks with this one weird trick

Summary:
Sanitize link and image urls on output.
Since there's only one output function for each, that seemed
like a safer place to sanitize than on parsing.

Depends on D13137

Test Plan:
Write some malicious things as links in the
[[simple-markdown-tester]] widget:

    [link](javascript:alert%28%27hi%27%29)

    [link][1]

    [1]: javascript:alert('hi');

And try some safe links and make sure they still work:

    [link](https://www.google.com)

    [link][1]

    [1]: https://www.google.com

Reviewers: emily

Reviewed By: emily

Subscribers: alpert

Differential Revision: http://phabricator.khanacademy.org/D13138