fix(auth): prevent open redirect via callback_ui (#3844)

Validate callback_ui and default invalid values to /.
Allow absolute callback_ui only when its origin is allowlisted via http.auth.openid.callbackAllowOrigins (and externalUrl).
Add/adjust unit + controller tests and update examples/docs for relative vs allowlisted absolute redirect

Signed-off-by: Andrei Aaron <andreifdaaron@gmail.com>

pkg/api/proxy.go

@@ -123,9 +123,9 @@ func proxyHTTPRequest(ctx context.Context, req *http.Request,
 	// Get HTTP TLS config safely
 	httpTLSConfig := ctrlr.Config.CopyTLSConfig()
 
-	proxyQueryScheme := "http"
+	proxyQueryScheme := constants.SchemeHTTP
 	if httpTLSConfig != nil {
-		proxyQueryScheme = "https"
+		proxyQueryScheme = constants.SchemeHTTPS
 	}
 
 	cloneURL.Scheme = proxyQueryScheme