fix: image and URL references refuse a /\ path, which browsers read as another host (WR-20)

safeImageURL and ValidURLRef refused only //, so a stored og_image of
/\evil.example/x.png loaded a third-party image in the admin. Both now
refuse /\ like models.validTarget already does.

tests/elements/image.test.ts

@@ -0,0 +1,18 @@
+import { describe, expect, it } from 'vitest'
+import { safeImageURL } from '../../assets/src/elements/image'
+
+// E7 golem15-seo-image: which stored URLs the preview may load.
+
+describe('E7 safeImageURL', () => {
+  it('accepts a path and an http(s) URL', () => {
+    for (const url of ['/media/a.png', 'https://cdn.example/a.png', 'HTTP://cdn.example/a.png']) {
+      expect(safeImageURL(url), url).toBe(true)
+    }
+  })
+
+  it('refuses addresses a browser reads as another host or another scheme (WR-20)', () => {
+    for (const url of ['//evil.example/x.png', '/\\evil.example/x.png', 'javascript:alert(1)', 'data:image/png;base64,AA', 'a.png', '']) {
+      expect(safeImageURL(url), url).toBe(false)
+    }
+  })
+})