Fix failing get_safe_url tests for latest Python 3.8 and 3.9

[potiuk]

The latest release of Python 3.8 and 3.9 have been just released that contain the fix to a security vulnerability backported to those versions:

python/cpython#102153

Release notes:

• https://www.python.org/downloads/release/python-3817/
• https://www.python.org/downloads/release/python-3917/

The fix improved sanitizing of the URLs and until Python 3.10 and 3.11 get released, we need to add the sanitization ourselves to pass tests on all versions.

In order to improve security of airflow users and make the tests work regardless whether the users have latest Python versions released, we add extra sanitisation step to the URL to apply the standard WHATWG specification.

---

^ Add meaningful description above

Read the Pull Request Guidelines for more information.
In case of fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
In case of a new dependency, check compliance with the ASF 3rd Party License Policy.
In case of backwards incompatible changes please leave a note in a newsfragment file, named {pr_number}.significant.rst or {issue_number}.significant.rst, in newsfragments.

[potiuk]

Example failing build: https://github.com/apache/airflow/actions/runs/5199718582/jobs/9378018845

=================================== FAILURES ===================================
_ test_get_safe_url[ javascript:alert(1)-http://localhost:8080/ javascript:alert(1)] _

mock_url_for = <MagicMock name='url_for' id='139816089007056'>
app = <Flask 'airflow.www.app'>, test_url = ' javascript:alert(1)'
expected_url = 'http://localhost:8080/ javascript:alert(1)'

    @pytest.mark.parametrize(
        "test_url, expected_url",
        [
            ("", "/home"),
            ("javascript:alert(1)", "/home"),
            (" javascript:alert(1)", "http://localhost:8080/ javascript:alert(1)"),
            ("http://google.com/", "/home"),
            ("google.com", "http://localhost:8080/google.com"),
            ("\\/google.com", "http://localhost:8080/\\/google.com"),
            ("//google.com", "/home"),
            ("\\/\\/google.com", "http://localhost:8080/\\/\\/google.com"),
            ("36539'%3balert(1)%2f%2f166", "/home"),
            (
                "http://localhost:8080/trigger?dag_id=test&origin=36539%27%3balert(1)%2f%2f166&abc=2",
                "/home",
            ),
            (
                "http://localhost:8080/trigger?dag_id=test_dag&origin=%2Ftree%3Fdag_id%test_dag';alert(33)//",
                "/home",
            ),
            (
                "http://localhost:8080/trigger?dag_id=test_dag&origin=%2Ftree%3Fdag_id%3Dtest_dag",
                "http://localhost:8080/trigger?dag_id=test_dag&origin=%2Ftree%3Fdag_id%3Dtest_dag",
            ),
        ],
    )
    @mock.patch("airflow.www.views.url_for")
    def test_get_safe_url(mock_url_for, app, test_url, expected_url):
        mock_url_for.return_value = "/home"
        with app.test_request_context(base_url="http://localhost:8080"):
>           assert get_safe_url(test_url) == expected_url
E           AssertionError: assert '/home' == 'http://local...ript:alert(1)/'
E             - http://localhost:8080/ javascript:alert(1)
E             + /home