Fix data: URI bypass restricted to src (#25)

[GreggFranklin]

Fix #25 - What changed: href and action now always go through esc_url(), which rejects data: (and javascript:) schemes — closing them as a redirect/script vector. The base64 exemption survives only for src, and I tightened the check from strpos(...) === false to === 0 so the data:image/png;base64, prefix must appear at the start of the value, not anywhere in it (previously a crafted string containing that substring mid-value would skip escaping entirely).