Serialize XML: omit invalid `anyURI` values

this appears to be invalid XML, but is still rendered:

> ... is not a valid value for 'anyURI'

```xml
      <externalReferences>
        <reference type="vcs">
          <url>git@github.com:peterolson/BigInteger.js.git</url>
          <comment>as detected from PackageJson property "repository.url"</comment>
        </reference>
      </externalReferences>
```
