Configurable scheme allow-list

[romain-pm]

Part of #749. The scheme allow-list is hardcoded to http, https, mailto, tel, ftp.

Jahia/jahia.com's partner website field is deliberately ^https?:// only, so the adoption kept the userland regex on top of the library check — the library is a floor it cannot raise.

• allowedSchemes?: readonly string[], per call and module-wide.
• Precedent on the image side and in Next.js: qualities, localPatterns and remotePatterns are all configurable allow-lists rather than fixed ones.
• Keep the default as it is. This is about narrowing, not widening — a project should be able to be stricter than the library without duplicating the check.