fix: guard null href in urls2links after jQuery removal

DOMPurify can strip the href from anchors created by the URL regex
(e.g. script-injection attempts), leaving <a> elements with no href
attribute. getAttribute('href') returns null in that case; the previous
.match() call on null crashed with TypeError.

jQuery's .attr('href') returned undefined and .match() was never
called, so the bug was silently hidden.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

js/privatebin.js

@@ -444,7 +444,8 @@ window.PrivateBin = (function () {
                 strict ? purifyHtmlConfigStrictSubset : purifyHtmlConfig
             );
             element.querySelectorAll('a').forEach(function (link) {
-                if (link.getAttribute('href').match(/^(?:(?:(?:f|ht)tps?|mailto|magnet):)/i)) {
+                const href = link.getAttribute('href');
+                if (href && href.match(/^(?:(?:(?:f|ht)tps?|mailto|magnet):)/i)) {
                     link.setAttribute('target', '_blank');
                     link.setAttribute('rel', 'nofollow noopener noreferrer');
                 }