feat(security): explicitly whitelist URL schemes for bootstrap. (#15427)
feat(security): explicitly whitelist URL schemes for bootstrap. (#15427)

Many browsers have some extension URL scheme. It is unclear how many of
those have the security issue of allowing parser-inserted loads of
extension URLs.

To be conservative, this code whitelists the URL schemes that are known
to be subject to CSP, i.e. the ones that are expected and safe.
reneploetz/angular.js,Narretz/angular.js,eistrati/angular.js,pbr1111/angular.js,jbedard/angular.js,pbr1111/angular.js,hnccho/angular.js,angularbrasil/angular.js,notebowl/angular.js,mosoft521/angular.js,lgalfaso/angular.js,rlugojr/angular.js,reneploetz/angular.js,laurent-le-graverend/angular.js,eistrati/angular.js,marcin-wosinek/angular.js,sunoterra/angular.js,rlugojr/angular.js,Narretz/angular.js,rjamet/angular.js,reneploetz/angular.js,BobChao87/angular.js,zuzusik/angular.js,sunoterra/angular.js,jbedard/angular.js,pondermatic/angular.js,ze-pequeno/angular.js,rjamet/angular.js,rbevers/angular.js,mosoft521/angular.js,marcin-wosinek/angular.js,ze-pequeno/angular.js,notebowl/angular.js,gkalpak/angular.js,mgol/angular.js,mgol/angular.js,petebacondarwin/angular.js,arunkannan/angular.js,Awingu/angular.js,kylewuolle/angular.js,lgalfaso/angular.js,mprobst/angular.js,dmuellner/angular.js,laurent-le-graverend/angular.js,arunkannan/angular.js,mosoft521/angular.js,yathos/angular.js,jbedard/angular.js,arunkannan/angular.js,ze-pequeno/angular.js,angular/angular.js,zuzusik/angular.js,mprobst/angular.js,kylewuolle/angular.js,sercaneraslan/angular.js,reneploetz/angular.js,kylewuolle/angular.js,nsina/angular.js,petebacondarwin/angular.js,angularbrasil/angular.js,angular/angular.js,eistrati/angular.js,kylewuolle/angular.js,ze-pequeno/angular.js,Awingu/angular.js,pondermatic/angular.js,rbevers/angular.js,BobChao87/angular.js,angularbrasil/angular.js,pbr1111/angular.js,Awingu/angular.js,rbevers/angular.js,zuzusik/angular.js,sunoterra/angular.js,jbedard/angular.js,hnccho/angular.js,gkalpak/angular.js,sercaneraslan/angular.js,pondermatic/angular.js,mosoft521/angular.js,laurent-le-graverend/angular.js,rbevers/angular.js,rjamet/angular.js,notebowl/angular.js,arunkannan/angular.js,petebacondarwin/angular.js,BobChao87/angular.js,angular/angular.js,gkalpak/angular.js,hnccho/angular.js,eistrati/angular.js,Narretz/angular.js,marcin-wosinek/angular.js,mgol/angular.js,angular/angular.js,mgol/angular.js,Hartmarken/angular.js,rlugojr/angular.js,nsina/angular.js,Hartmarken/angular.js,Narretz/angular.js,yathos/angular.js,Hartmarken/angular.js,pondermatic/angular.js,BobChao87/angular.js,dmuellner/angular.js,lgalfaso/angular.js,notebowl/angular.js,Hartmarken/angular.js,petebacondarwin/angular.js,angularbrasil/angular.js,yathos/angular.js,sercaneraslan/angular.js,mprobst/angular.js,sercaneraslan/angular.js,lgalfaso/angular.js,marcin-wosinek/angular.js,pbr1111/angular.js,hnccho/angular.js,rlugojr/angular.js,nsina/angular.js,sunoterra/angular.js,dmuellner/angular.js,zuzusik/angular.js,nsina/angular.js,Awingu/angular.js,gkalpak/angular.js,yathos/angular.js,mprobst/angular.js,laurent-le-graverend/angular.js,rjamet/angular.js,dmuellner/angular.js