Fix PHP 8.5 deprecations in URISchemeRegistry and RemoveSpansWithoutAttributes

URISchemeRegistry::getScheme() can receive null when a URI has no scheme
(relative URIs). PHP 8.5 deprecates null as an array offset — add an
early return for null scheme.

SplObjectStorage::attach(), contains(), detach() are deprecated in PHP 8.5
in favour of offsetSet(), offsetExists(), offsetUnset(). Update
RemoveSpansWithoutAttributes to use the new method names.

Author: maxfenton

library/HTMLPurifier/Injector/RemoveSpansWithoutAttributes.php

@@ -74,7 +74,8 @@ public function handleElement(&$token)
 
         if ($current instanceof HTMLPurifier_Token_End && $current->name === 'span') {
             // Mark closing span tag for deletion
-            $this->markForDeletion->attach($current);
+            // PHP 8.5: SplObjectStorage::attach() deprecated in favour of offsetSet()
+            $this->markForDeletion->offsetSet($current);
             // Delete open span tag
             $token = false;
         }
@@ -85,8 +86,10 @@ public function handleElement(&$token)
      */
     public function handleEnd(&$token)
     {
-        if ($this->markForDeletion->contains($token)) {
-            $this->markForDeletion->detach($token);
+        // PHP 8.5: SplObjectStorage::contains()/detach() deprecated in favour of
+        // offsetExists()/offsetUnset()
+        if ($this->markForDeletion->offsetExists($token)) {
+            $this->markForDeletion->offsetUnset($token);
             $token = false;
         }
     }

library/HTMLPurifier/URISchemeRegistry.php

@@ -44,6 +44,12 @@ public function getScheme($scheme, $config, $context)
             $config = HTMLPurifier_Config::createDefault();
         }
 
+        // PHP 8.5: null as array offset is deprecated; URIs without a scheme
+        // (e.g. relative URIs) produce a null $scheme — bail out early.
+        if ($scheme === null) {
+            return;
+        }
+
         // important, otherwise attacker could include arbitrary file
         $allowed_schemes = $config->get('URI.AllowedSchemes');
         if (!$config->get('URI.OverrideAllowedSchemes') &&