fix: XSS injection with Querybook RichTextEditor

[czgu]

Currently, if a user inputs a javascript:alert() into the URL, it would XSS inject any users on that doc who clicks the link. This fix is backward compatible where all non-http/https urls will cease to work.

Previous Behavior

1. Create a new DataDoc
2. Create a text cell and enter text "foo"
3. Select the text and assign URL "javascript:alert()"
4. Click on the URL and notice the alert is triggered.

Current Behavior
Step 1-3: same as above
4. When clicking on the URL, a blank page will be opened.