Add support for only one last `@supportURL`, fix naming standardization, and such

**PR ready for evaluation with a question or two**

---

**NOTE**: It appears that Zren is using `.meta` to be the actual metadata block item names and so any manipulation of these should be stored elsewhere just in case `@collaborators`, `@homepages`, `@supportURLS`, etc. is ever used/supported directly in a metadata block... doubt it will based off of Anthony's prior responses for other keys but does make the code here simpler to read... and we don't need to be potentially overwriting user specified keys even if they don't really exist anywhere.

Applies to:
* #191
* #174
* #161

---

`@supportURL` is a pseudo unique key *(e.g. non-upmixed)* in our context as per the implied concern, especially at https://github.com/OpenUserJs/OpenUserJS.org/issues/96#issuecomment-42913651, around that issue. Authors can of course specify more at any time in their source but we only display/recognize the last one like GM standards for conflict resolution keys *(and Scriptish probably already does for [this exact key](/scriptish/scriptish/wiki/Manual%3A-Metadata-Block#supporturl-new-in-scriptish))*. I don't know of anyone yet that would want to have to check multiple places for issues. We could, at a future date, alter our issue tracker linkage if a user doesn't specify us as the primary. Some thoughts to ponder on... but that's another pr/issue down the line perhaps.

---

Tested on dev at [this script](http://localhost:8080/scripts/marti/httplocalhost.localdomain/RFC_2606%C2%A73_-_license_and_licence_Unit_Test) using this metadata block:

``` javascript
// ==UserScript==
// @name          RFC 2606§3 - @license and @licence Unit Test
// @namespace     http://localhost.localdomain
// @description   Tests out non-unique keys
// @copyright     2007+, Marti Martz (http://userscripts.org/users/37004)
// @license       GPL version 3 or any later version; http://www.gnu.org/copyleft/gpl.html
// @licence       (CC); http://creativecommons.org/licenses/by-nc-sa/3.0/
// @version       2014.06.19.1
// @icon          https://s3.amazonaws.com/uso_ss/icon/13701/large.png

// @include   http://www.example.com/*
// @include   http://www.example.net/*
// @include   http://www.example.org/*

// @author Marti
// @collaborator jerone
// @collaborator sizzle
// @collaborator Zren

// @homepageURL https://openuserjs.org/scripts/marti/httplocalhost.localdomain/RFC_2606%C2%A73_-_license_and_licence_Unit_Test
// @homepage    http://localhost:8080/scripts/marti/httplocalhost.localdomain/RFC_2606%C2%A73_-_license_and_licence_Unit_Test
// @supportURL  http://example.com
// @supportURL  https://openuserjs.org/scripts/marti/httplocalhost.localdomain/RFC_2606%C2%A73_-_license_and_licence_Unit_Test/issues
// @supportURL  http://localhost:8080/scripts/marti/httplocalhost.localdomain/RFC_2606%C2%A73_-_license_and_licence_Unit_Test/issues

// ==/UserScript==
```

Only thing I could think of is if an inexperienced user would accidentally click on this type of link with a script and add an event listener to monitor keystrokes... Sanitizing it keeps it from doing this. Also sizzle mentioned the stealing cookie bit... so a cross-domain call or even within the same domain posting somewhere could be achieved. The html tag sanitization is used in case anyone accidentally uses `{{{text}}}` and commits a bug. So basically a two fold op here. If you have any other recommendations we don't have to use this. I am just fixing and having to clean up the bug introduced from the new UI in #103 and #129. Reusing existing objects *(methods)* already in memory will help the drones too. As I've mentioned before I'm not blaming because we all make mistakes and I propagated this one... and then sizzle caught it. I'm quite thankful for all the verification/testing provided. :)