validate exit url protocol in amp-ad-exit

[rootvector2]

the exit() handler navigates to a creative-controlled finalUrl through win.open/HostServices.openUrl without a scheme check, so a creative configuring finalUrl (or a substituted var) as javascript:/data: reaches navigation while every other nav path goes through Navigation.navigateTo and rejects it via isProtocolValid; this validates the substituted finalUrl before any exit, found while comparing amp-ad-exit's direct win.open against navigation.js.

[CLAassistant]

All committers have signed the CLA.

[powerivq]

Looks good. Just need to sign CLA and rebase against latest main branch before we can merge this.

[powerivq]

@rootvector2 lmk if you need help doing these.

[rootvector2]

rebased on latest main, and the CLA check is already green. heads up though: CI was red before the rebase, not because of it. substituteVariables -> expandUrlSync already runs ensureProtocolMatches_ -> userAssert(isProtocolValid), so a literal javascript:/data: finalUrl was throwing inside substitution before my guard ran. moved the isProtocolValid check ahead of substitution so a bad protocol gets rejected cleanly, and added the repo's no-script-url exception for the test's literal. all squashed into 7185b1c.