Fix URL protocol validation and parsing attribute values with multiple URLs

[westonruter]

This is a follow-up on #983 to fix two problems:

1. URL protocol validation was failing when a URL contained a colon, as the plugin was incorrectly assuming everything before it was the scheme. The characters being checked for in the protocol were also incorrect.
2. URLs with commas were incorrectly raising validation errors. Attribute values containing URLs were always getting split by commas to handle the srcset case. However, this attribute is the only one that contains a comma-separated list of URLs (among other descriptors), so it doesn't make sense to split every attribute value by commas. This ensures that a URL containing a latitude and longitude separated by a comma won't require its comma to be URL-encoded as %2C to avoid sanitization.

Fixes #1410.

[amedina]

Good changes; resulting in more modular and legible code.