Add secureconverturls filter to prevent JavaScript and HTML tag injections

Since this would change the behaviour of the converturls filter (like make it impossible to in a secure way let a tags be passed through as they could contain JavaScript), I added a new filter called secureconverturls instead. Feel free to change code in any way needed as long as pre_escape is used I think the HTML output should be safe. The only thing I'm sure of is if there are any variations of strings that could be converted to something like <a href="javascript:alert('hello');">alert</a>, I tested a few like domain.com/news;javascript:alert('hello'); and it seems okay...