PHP: Reject malformed and potentially evil input when outputting HTML

* Ensure that HTML tag names are valid tag names.
* Ensure that HTML attribute names are valid attribute names.
* Reject potentially unsafe URL protocols

I am not entirely sure about the last one; seems like this really
should be the library's user's responsibility to validate. But it
shouldn't hurt to have it.

Bug: 73156
Change-Id: I5e64e8447563d0f92129434ea660468920318f79
Merge "PHP: Reject malformed and potentially evil input when outputting HTML"