fix(sanitizer): reject non-web schemes in iframe source URLs

The iframe allowlist was checked against the URL host alone, which
url.Parse populates regardless of scheme. A source such as
javascript://youtube.com/%0Aalert(document.domain) therefore matched an
allowlisted domain and was rendered as-is.

Parse the source URL and only accept http, https, and protocol-relative
URLs before looking up the domain. Comparisons keep using the host with
its port so that INVIDIOUS_INSTANCE values that include one still match.