CB-7291: Add defaults to external whitelist
CB-7291: Only add file, content and data URLs to internal whitelist
CB-7291: Restrict meaning of "*" in internal whitelist to just http and https