fix(17): CR-01 refuse non-http sitemap URLs on save, import and output

A url item stored as javascript://%0aalert(1)%0a//x passed Url::to and
reached <loc>, which sitemap.xsl renders as a link on the site origin.

- The definitions form refuses, per row, a url that is not a path or an
  http(s) URL (classes.AllowedItemURL) and a urlPattern that is not a
  path (signpost.ValidItemPattern), keyed data.<i>.url / .urlPattern.
- Generator.addItem drops a loc or alternate that is not http(s).
- sitemap:import-winter drops such url items and clears such patterns
  with a report line; sitemap:import refuses such an entry.

classes/generator_test.go

@@ -149,3 +149,35 @@ func TestURLCap(t *testing.T) {
 		t.Fatalf("no items = %q %v", empty, err)
 	}
 }
+
+// TestOnlyHTTPLocs pins the CR-01 output filter: a URL that Url::to keeps
+// but that is not http or https (a javascript: URL FILTER_VALIDATE_URL
+// accepts, mailto:, a bare fragment) is not written and not counted. A
+// protocol-relative URL comes out of Url::to on the root host.
+func TestOnlyHTTPLocs(t *testing.T) {
+	gen := &classes.Generator{Root: "https://api.example.test"}
+	xml, err := gen.Generate(context.Background(), urlItems(
+		"javascript://%0aalert(1)%0a//x",
+		"JavaScript://example.test/%0aalert(1)",
+		"//evil.test/x",
+		"mailto:a@example.test",
+		"#top",
+		"/ok",
+		"https://other.example.test/page",
+	))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if n := strings.Count(xml, "<url>"); n != 3 {
+		t.Fatalf("%d url elements, want 3:\n%s", n, xml)
+	}
+	if !strings.Contains(xml, "<loc>https://api.example.test/evil.test/x</loc>") {
+		t.Fatalf("the protocol-relative URL did not stay on the root host:\n%s", xml)
+	}
+	if strings.Contains(strings.ToLower(xml), "javascript") || strings.Contains(xml, "mailto:") || strings.Contains(xml, "#top") {
+		t.Fatalf("a non-http URL was written:\n%s", xml)
+	}
+	if !strings.Contains(xml, "<loc>https://api.example.test/ok</loc>") || !strings.Contains(xml, "<loc>https://other.example.test/page</loc>") {
+		t.Fatalf("an http(s) URL is missing:\n%s", xml)
+	}
+}