Raised in https://github.com/spring-projects/spring-boot/issues/25384, I think it makes sense to sanitize the values of url and urls fields in the same way as we sanitize the values of uri and uris fields.

Flagging for team attention in case I've overlooked a reason for URLs to be handled differently to URIs.