New protocol check for href doesn't support root-relative URLs

@berdir can you please provide a list of steps to reproduce the issue?

Created a merge request, works for us, but not sure if there's a better way to deal with this in general.

Added steps to reproduce.

MR is merged. Thank you @berdir!

I thought I clicked the boxes for issue credit, but they're not checked. Trying again.

Incidentally, this should not have been a Critical bug, per the definitions → . This did not bring down a site or cause a security issue, it just broke certain content. Changing to Major.

Sorry but the problem persists if the image is presented in summary.

This code works in full page only:

<a href="//externalcontent.com/image.webp" class="colorbox">
  <img src="//externalcontent.com/image_mini.webp" />
</a>

To make it work in summary I have to add "https":

<a href="https://externalcontent.com/image.webp" class="colorbox">
  <img src="//externalcontent.com/image_mini.webp" />
</a>

Saw the e-mail notification and came here to say that this should also work fine for protocol-relative paths as we just look for starting with /. but you edited your comment already.

That said, protocol-relative paths are discouraged and should not be used anymore, just always use https:// (or root relative paths), see https://www.designcise.com/web/tutorial/why-protocol-relative-url-are-no....