mark data: urls as unsafe on iframe[src] and object[data]

[rootvector2]

The URL sanitizer only neutralizes data: URLs on <embed src>. <iframe src> and <object data> also load their URL as a nested document, so data:text/html,<script>…</script> is rendered and runs script. For iframe the value reaches sanitizeAttributeValue but only javascript:/vbscript: are rejected; for object requiresSanitization returns false and the value is written raw.

The new checkDataProtocol path rejects data: (and javascript:/vbscript:) for those two tags while leaving normal http(s) and relative URLs alone, so legitimate iframes and objects keep working. Repro on https://limber.glimdown.com renders the script for an <object data={{this.url}}> bound to a data:text/html value.