fix(17): CR-01 refuse non-http sitemap URLs on save, import and output

A url item stored as javascript://%0aalert(1)%0a//x passed Url::to and
reached <loc>, which sitemap.xsl renders as a link on the site origin.

- The definitions form refuses, per row, a url that is not a path or an
  http(s) URL (classes.AllowedItemURL) and a urlPattern that is not a
  path (signpost.ValidItemPattern), keyed data.<i>.url / .urlPattern.
- Generator.addItem drops a loc or alternate that is not http(s).
- sitemap:import-winter drops such url items and clears such patterns
  with a report line; sitemap:import refuses such an entry.

lang/en/lang.yaml

@@ -37,6 +37,9 @@ item:
   save_definition: Saving Definition...
   load_indicator: Emptying Definition...
   empty_confirm: Empty this definition?
+errors:
+  url_scheme: Use a path such as /about, or a link that starts with http:// or https://.
+  url_pattern: Use a path that starts with a single /, for example /blog/:slug.
 definition:
   not_found: No sitemap definition was found. Try creating one first.
   title: Sitemap definition

lang/pl/lang.yaml

@@ -37,6 +37,9 @@ item:
   save_definition: Zapisywanie definicji...
   load_indicator: Czyszczenie definicji...
   empty_confirm: Wyczyścić tę definicję?
+errors:
+  url_scheme: Podaj ścieżkę, np. /o-nas, albo link zaczynający się od http:// lub https://.
+  url_pattern: Podaj ścieżkę zaczynającą się od jednego /, np. /blog/:slug.
 definition:
   not_found: Nie znaleziono definicji mapy strony. Musisz ją utworzyć.
   title: Definicja mapy strony