Tighter safety checks on media links in published posts

Added missing automated checks around how insecure and scheme-less media links are filtered out of published posts, so a future change cannot quietly weaken that filtering without a test catching it. No visible change to posts today.