XSS vulnerability in URL tags

I believe `javascript:` URLs ought to be filtered. URL tags currently allows embedding malicious inline scripts:

```php
$bbcode = new ChrisKonnertz\BBCode\BBCode();

echo $bbcode->render("[url=javascript:alert('hacked')]malicious link[/url]");
```