fix(isURL): fix CVE-2025-56200

[WikiRik]

This is a fix for CVE-2025-56200. Additional test cases are partially generated by generative AI.

The rewrite was done by a different generative AI process, and needs to be properly reviewed before this PR is ready

Checklist

• PR contains only changes related; no stray files, etc.
• README updated (where applicable)
• Tests written (where applicable)
• References provided in PR (where applicable)

[codecov]

Codecov Report

❌ Patch coverage is 79.61165% with 21 lines in your changes missing coverage. Please review.
✅ Project coverage is 99.14%. Comparing base (6f436be) to head (6e92526).

Files with missing lines	Patch %	Lines
src/lib/isURL.js	79.61%	12 Missing and 9 partials ⚠️

Additional details and impacted files

@@             Coverage Diff             @@
##            master    #2610      +/-   ##
===========================================
- Coverage   100.00%   99.14%   -0.86%     
===========================================
  Files          114      114              
  Lines         2536     2583      +47     
  Branches       642      657      +15     
===========================================
+ Hits          2536     2561      +25     
- Misses           0       13      +13     
- Partials         0        9       +9     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

To fix the problem in line 222, ensure that the result of indexOf('://') is not -1 before making a position comparison. The best practice would be:

• Store originalUrl.indexOf('://') in a variable (e.g., protoIdx).
• Check that protoIdx !== -1 && protoIdx === originalUrl.length - 3

This avoids the case where both sides are -1 due to missing substring, and thus avoids a false positive. Restrict the change to just the affected region around line 222.

No new methods or complex imports are needed—just a minor code change to add the variable and condition.

---