Escape what the monitor page renders, and put the helpers where every page can reach them

The page interpolated media titles, partner hostnames read over the mesh, and docker folder
names straight into innerHTML — its own header claimed otherwise, and the helpers that would
have fixed it were defined in a page it never loads. Container WebUI values now get a scheme
check before they reach window.open().

Plugin/unraid/include/docker_folders.php

@@ -44,6 +44,13 @@ function vv_container_webui(string $name, array $portMap): string {
         return $portMap[$name][$pm[1]] ?? $pm[1];
     }, $url);
 
+    // Scheme allowlist, applied here so a bad value never reaches the page rather than being
+    // filtered at each sink. A WebUI entry is http or https in every real template; anything else
+    // is either broken or a javascript: URL aimed at whoever clicks it. These files come from
+    // Community Applications and hand edits, so they are not ours to trust. include/docs.php
+    // applies the same rule to markdown links for the same reason.
+    if (!preg_match('#^https?://#i', $url)) return '';
+
     return $url;
 }