🇮🇳India @u.tyagi

This issue is valid since dangerous protocols are omitted from link Paths in new 7.x core. In this particular case, this can be handled by strictly allowing only Highcontrast related function calls through the same chain. This can be done via edition includes/common.inc [line: 2621] and adding the functions in array variable $skip_js_paths.
The values that needs to be added should be in lowercase for it to work. i.e.
[...........,'javascript:drupalhighcontrast.enablestyles()','javascript:drupalhighcontrast.disablestyles()']