Add attribute sanitization for href, src and style

This reuses code from the Parsoid Sanitizer class. We should start using the
separate AttributeSanitizer from Parsoid too, so that we can directly share
the code for this.

TODO: Use the wiki-configured list of valid href protocols.