[ci skip] xss_clean() hardening

- percent-sign tag (IE)
- data: URI scheme inclinding whitespace (Chrome)
2 files changed