Prefer explicit rules over regexp

[KN4CK3R]

175 introduced a potential dangerous change. If a user registers the regexp .+ for scheme validation (as written in the comment) to allow all possible schemes, a link like <a href="javascript:..."> is valid too. The Go regexp module does not implement negative lookaheads, so you can't write "all but xyz" ((?!javascript|vbscript)).

This PR moves the regexp check a little bit down to be only executed if there was no other explicit scheme registration was found. So now

p.AllowURLSchemesMatching(regexp.MustCompile(`.+`))
p.AllowURLSchemeWithCustomPolicy("javascript", func(*url.URL) bool {
    return false
})

will allow every scheme but javascript.

An alternative would be to drop AllowURLSchemesMatching again and add methods DisallowURLSchemes and DisallowURLSchemeWithCustomPolicy.

[buro9]

Thank you, this is an excellent catch and a great addition.