fix: reject trailing newline in slug and control characters in telnet URIs

[nandgator]

Follow-up to #439 and #446, whose review fixes did not make it into the merge.

• slug(): use fullmatch so $ no longer accepts a trailing newline (Django's validate_slug anchors with \Z for the same reason).
• telnet URIs: urlsplit silently strips tabs and newlines, so telnet://example.com\n and telnet://exa\nmple.com were accepted. Reject whitespace and non-printable characters up front, and fix a docstring typo.

Both come with tests.

🤖 Generated with Claude Code