Add URL sanitation to avoid javascript: links

Summary:
Original code taken from
https://github.com/chjj/marked/commit/904c71b7713979b01d5bc5264c2808c73fef99a7

Test plan:
Added this to https://github.com/Khan/perseus and made an image, a link,
an autolink, and a url (technically, the regex recongizing this already
seems to ignore javascript: links, but sanitizing everything seems to
make more sense than doing it only when obviously necessary), all
starting with javascript:, and made sure that none of them executed the
javascript.
Make URL sanitation stricter

Summary:
ignores all characters outside of A-Za-z0-9 when checking for a leading
'javascript:' in the URL.

Test Plan:
Made a javascript link in perseus, checked that it was sanitized to '#'
Merge pull request #3 from jacktoole1/master

Add URL sanitation to avoid javascript: links