HtmlPolicyBuilder.allowUrlProtocols() doesn't work about java-html-sanitizer HOT 3 CLOSED

Thanks.  That was really stupid of me.  Luckily, the bug does not result in a 
breach..

Since the ':' is always included in the checked bit, an attack like

    <a href="javascript:!alert(1337)?0:http">...</a>

will not work because the (s.substring(i)) checked against the allowed protocol 
set in

    if (!protocols.contains(s.substring(i))) { return null; }

would be ":http", not "http" in the above example and naive policy developers 
are unlikely to whitelist ":http".

Patch accepted.  Thanks.

Cut a release with this fix at r99.