handlers: tighten up /redirect-to target validation

[mccutchen]

Noticed some very malicious requests getting successful 302 responses from /redirect-to instead of the 403s I expected while peeking at live traffic to https://httpbingo.org, e.g.:

/redirect-to?url=http%253A//%255B%253A%253Affff%253A169.254.169.254%255D/latest/meta-data/
/redirect-to?url=http%253A%252F%252F169.254.169.254%252Flatest%252Fmeta-data%252Fiam%252Fsecurity-credentials%252F
/redirect-to?url=http%253A%252F%252Flocalhost%253A8080%252Factuator%252Fenv&status_code=302

This tightens up the redirect target validation to require either an absolute or a root-relative URL.

Note: This is technically a breaking change.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.83%. Comparing base (9fa1607) to head (0b22670).

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #266      +/-   ##
==========================================
+ Coverage   94.81%   94.83%   +0.01%     
==========================================
  Files           9        9              
  Lines        2027     2032       +5     
==========================================
+ Hits         1922     1927       +5     
  Misses         62       62              
  Partials       43       43              

Files with missing lines	Coverage Δ
httpbin/handlers.go	98.29% <100.00%> (+<0.01%)	⬆️

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.