sessions: fix open redirect in login page.

Fix an open redirect exploit where if you went to <https://danbooru.donmai.us/login?url=//fakebooru.com>,
then after you logged in you would be redirected to https://fakebooru.com.

This was actually fixed by the upgrade to Rails 7.0. `redirect_to` now
raises an `UnsafeRedirectError` on redirect to an offsite URL. Before we
tried to prevent offsite redirects by checking that the URL started with
a slash, but this was insufficient - it allowed protocol-relative URLs
like `//fakebooru.com`.

Add a test case for protocol-relative URLs and return a 403 error on an
offsite redirect.

app/controllers/sessions_controller.rb

@@ -16,9 +16,9 @@ class SessionsController < ApplicationController
   def create
     name, password, url = params.fetch(:session, params).slice(:name, :password, :url).values
     user = SessionLoader.new(request).login(name, password)
+    url ||= posts_path
 
     if user
-      url = posts_path unless url&.start_with?("/")
       respond_with(user, location: url)
     else
       flash.now[:notice] = "Password was incorrect"