Fix the XSS filter alter

This is a followup to a reported security issue. Due to inability to find a working exploit we are allowed to release it as a public bugfix.

Problem/Motivation

CKEditor 5 Premium Features alters a XSS filter to avoid removing colons in attributes that store the suggestion and comment ids, however it may also prevent removing a colon in href attribute in case link element contains suggestion-start, suggestion-end, comment-start or comment-end attribute.
Example code <a suggestion-start name=foo href="javascript:alert()">Foo</a> will result in preserving a javascript in the content, however CKEditor 5 will block its execution itself. We have also checked other WYSIWYG editor available in contrib space - it also does block such script execution.

Proposed resolution

We have prepared a patch that adds skipping our XSS filter alteration if Comments or Track Changes plugins are not active or the used editor is not CKEditor 5.
Additionally regular expressions are changed to better match exactly the attributes that we need to preserve the ids.