fix: use safeURLs for api and local gw
fix: use safeURLs for api and local gw

This fixes webui when embedded js-ifps is used in Brave.

Without normalization, state.webuiRootUrl used 127.0.0.1 while gw one
was localhost, and the script responsible for pointing webui at the
correct (non-5001) API port was not called because webui root did not
match.

lidel/ipfs-firefox-addon,lidel/ipfs-firefox-addon,lidel/ipfs-firefox-addon