True when a link/image URL is safe to render. Relative URLs (no scheme) are allowed; absolute URLs must use a scheme from SAFE_URL_SCHEMES. Leading ASCII control characters and spaces — which browsers strip before resolving a scheme — are removed first so java\tscript: can't sneak through.