URLs exported to JavaScript in Customizer settings get double-encoded

[westonruter]

The Customizer currently fails to load URLs into the preview if they contains multiple query parameters.

For example, to preview in Customizer this URL: http://src.wordpress-develop.dev/?foo=bar&bar=baz

One would navigate to: http://src.wordpress-develop.dev/wp-admin/customize.php?url=http%3A%2F%2Fsrc.wordpress-develop.dev%2F%3Ffoo%3Dbar%26bar%3Dbaz

Upon loading up the customizer, however, you may inspect the wp.customize.settings.url.preview in the browser console and see that its value is: http://src.wordpress-develop.dev/?foo=bar&bar=baz

Notice how the & gets HTML-escaped. This is because customize.php is using esc_url for values being added to an array which is exported to JavaScript via json_encode. Instead of esc_url, the esc_url_raw function should be used instead.

[westonruter]

Use esc_url_raw() instead of esc_url()

[nacin]

Seems fine to me. Would want to double-check how this URL gets used in JS.

[westonruter]

Also use esc_url_raw() for url.allowed. Props ocean90

[ocean90]

In 27574:

Customizer: Use esc_url_raw to escape customizer URL settings to prevent double encoding.

props westonruter, ocean90.
fixes #26569.