fix: missing normalization of the protocol in URLs allows bypassing forbidden protocols

[functionofpwnosec]

Code that uses KaTeX's trust option, specifically that provides a function to block-list certain URL protocols, can be fooled by URLs in malicious inputs that use uppercase characters in the protocol. In particular, this can allow for malicious input to generate javascript: links in the output, even if the trust function tries to forbid this protocol via trust: (context) => context.protocol !== 'javascript'.

trust: (context) => context.protocol.toLowerCase() !== 'file'

CVE-2024-28246
CWE-184