Turn what a person typed into a safe absolute URL, or null.
Parameters
raw: string
Returns string|null
Remarks
A bare example.com becomes https://example.com/; javascript:, data:
and every other scheme outside http/https/mailto/tel never pass. The
result is the URL as the browser normalises it (a trailing slash is added
to a bare origin).
Turn what a person typed into a safe absolute URL, or
null.