feat: allow custom protocols for app href

[frankvHoof93]

Allow other protocols (such as ftp://, steam://, rdp://) whilst still blocking javascript.

Homarr

Thank you for your contribution. Please ensure that your pull request meets the following pull request:

• Builds without warnings or errors (pnpm build, autofix with pnpm format:fix)
• Pull request targets dev branch
• Commits follow the conventional commits guideline
• No shorthand variable names are used (eg. x, y, i or any abbrevation)

[deepsource-io]

Here's the code health analysis summary for commits 71516e0..089bf77. View details on DeepSource ↗.

Analysis Summary

Analyzer	Status	Summary	Link
JavaScript	✅ Success		View Check ↗

---

💡 If you’re a repository administrator, you can configure the quality gates from the settings.

[ajnart]

We already saw that users will always find new ways to use homarrr, having this restriction to only HTTP in the first place is restrictive, we could just define proper CSP rules so that it shows "VM1705:1 Refused to run the JavaScript URL because it violates the following Content Security Policy" error.

Either way we are not responsible for anyone's use of homarr, i'd remove the validation and expect my users to be smart enough to understand that a link is meant to be used there

[manuel-rw]

I made some research and believe that CSP should be enough to protect the user. I will update the PR...
Review with https://report-uri.com/home/generate

[manuel-rw]

@Meierschlumpf can you confirm CSP didn't break your setup?

[Meierschlumpf]

I haven't tried with iframes / similar as I don't really have a setup myself. But I've tried to get around our javascript restrictions and fixed the relevant things. If you want I can also try out with iframes / images

[manuel-rw]

I can confirm that nothing is broken on my dashboards. I will merge