fix(17): CR-01 refuse non-http sitemap URLs on save, import and output

A url item stored as javascript://%0aalert(1)%0a//x passed Url::to and
reached <loc>, which sitemap.xsl renders as a link on the site origin.

- The definitions form refuses, per row, a url that is not a path or an
  http(s) URL (classes.AllowedItemURL) and a urlPattern that is not a
  path (signpost.ValidItemPattern), keyed data.<i>.url / .urlPattern.
- Generator.addItem drops a loc or alternate that is not http(s).
- sitemap:import-winter drops such url items and clears such patterns
  with a report line; sitemap:import refuses such an entry.

classes/generator.go

@@ -196,7 +196,8 @@ func (g *Generator) manifest() Manifest {
 // missing URL filled through Url::to, lastmod from the record or the
 // manifest, BeforeAddItem, an empty URL dropped and the URL passed through
 // Url::to again, the count, the tier or item priority, the elements and
-// AddItem.
+// AddItem. Unlike PHP, a URL or alternate that does not come out as an
+// http or https URL is dropped.
 func (g *Generator) addItem(ctx context.Context, item *models.DefinitionItem, info itemInfo) error {
 	if g.count >= MaxURLs {
 		return nil
@@ -229,6 +230,12 @@ func (g *Generator) addItem(ctx context.Context, item *models.DefinitionItem, in
 		return nil
 	}
 	loc := URLTo(g.Root, info.url)
+	if !httpURL(loc) {
+		// Only http and https URLs are written: a javascript: or other
+		// scheme that an import, a registry type or a pattern let through
+		// would be a clickable link in sitemap.xsl.
+		return nil
+	}
 	g.count++
 	priority, ok := g.Tiers.Priority(loc, g.Settings)
 	if !ok {
@@ -242,7 +249,11 @@ func (g *Generator) addItem(ctx context.Context, item *models.DefinitionItem, in
 	}
 	if len(info.alternates) > 1 {
 		for _, a := range info.alternates {
-			entry.Alternates = append(entry.Alternates, Alternate{Hreflang: a.Hreflang, Href: URLTo(g.Root, a.Href)})
+			href := URLTo(g.Root, a.Href)
+			if !httpURL(href) {
+				continue
+			}
+			entry.Alternates = append(entry.Alternates, Alternate{Hreflang: a.Hreflang, Href: href})
 		}
 	}
 	if g.Events != nil {