Check out the W3C's list of HTML attributes, there's a "type" column in there and just look for URI types.
And of course the HTML 5 version of that list is useful too (edit: updated link for HTML 5.2 here)
So for HTML4 we've got:
<a href=url><applet codebase=url><area href=url><base href=url><blockquote cite=url><body background=url><del cite=url><form action=url><frame longdesc=url> and <frame src=url><head profile=url><iframe longdesc=url> and <iframe src=url><img longdesc=url> and <img src=url> and <img usemap=url><input src=url> and <input usemap=url><ins cite=url><link href=url><object classid=url> and <object codebase=url> and <object data=url> and <object usemap=url><q cite=url><script src=url>
HTML 5 adds a few (and HTML5 seems to not use some of the ones above as well):
<audio src=url><button formaction=url><command icon=url><embed src=url><html manifest=url><input formaction=url><source src=url><track src=url><video poster=url> and <video src=url>
These aren't necessarily simple URLs:
<img srcset="url1 resolution1, url2 resolution2"><source srcset="url1 resolution1, url2 resolution2"><object archive=url> or <object archive="url1 url2 url3"><applet archive=url> or <applet archive=url1,url2,url3><meta http-equiv="refresh" content="seconds; url">
SVGs can also contain links to resources: <svg><image href="url" /></svg>
In addition, the style attribute can contain css declarations with one or several urls. For example: <div style="background: url(image.png)">
与恶龙缠斗过久,自身亦成为恶龙；凝视深渊过久,深渊将回以凝视…
