GHSA-5qhf-9phg-95m2: Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons

Loofah::HTML5::Scrub.allowed_uri? does not correctly reject javascript: or vbscript: URIs when the scheme is split by a numeric character reference that has no trailing semicolon. A browser decodes such references and resolves the URL to an executable javascript: scheme, while allowed_uri? reports it safe.