fix(auth): prevent open redirect via callback_ui (#3844)

Validate callback_ui and default invalid values to /.
Allow absolute callback_ui only when its origin is allowlisted via http.auth.openid.callbackAllowOrigins (and externalUrl).
Add/adjust unit + controller tests and update examples/docs for relative vs allowlisted absolute redirect

Signed-off-by: Andrei Aaron <andreifdaaron@gmail.com>

pkg/api/constants/consts.go

@@ -22,6 +22,8 @@ const (
 	SessionClientHeaderValue     = "zot-ui"
 	APIKeysPrefix                = "zak_"
 	CallbackUIQueryParam         = "callback_ui"
+	SchemeHTTP                   = "http"
+	SchemeHTTPS                  = "https"
 	APIKeyTimeFormat             = time.RFC3339
 	// CreatePermission is an authz permission for create actions.
 	CreatePermission = "create"