This is not very clear from the documentation, but apparently moodle_url should not be used for representing URLs in general, only those which are created in code. There is a bit of warning about this but it's not that strong and I missed it...

I used moodle_url in a bunch of places in media library, which it seems is not appropriate.

Changes:

1) Remove all use of moodle_url in media library.

2) Change/add to phpdoc for moodle_url to explain that it must be used only for URLs created by code within moodle and must not be constructed from user-entered full url string.

To integrators: This needs to be integrated after MDL-33116.