sessions: fix open redirect in login page.

Fix an open redirect exploit where if you went to <https://danbooru.donmai.us/login?url=//fakebooru.com>,
then after you logged in you would be redirected to https://fakebooru.com.

This was actually fixed by the upgrade to Rails 7.0. `redirect_to` now
raises an `UnsafeRedirectError` on redirect to an offsite URL. Before we
tried to prevent offsite redirects by checking that the URL started with
a slash, but this was insufficient - it allowed protocol-relative URLs
like `//fakebooru.com`.

Add a test case for protocol-relative URLs and return a 403 error on an
offsite redirect.

test/functional/sessions_controller_test.rb

@@ -43,6 +43,11 @@ class SessionsControllerTest < ActionDispatch::IntegrationTest
         assert_redirected_to tags_path
       end
 
+      should "not allow redirects to protocol-relative URLs" do
+        post session_path, params: { name: @user.name, password: "password", url: "//example.com" }
+        assert_response 403
+      end
+
       should "not allow IP banned users to login" do
         @ip_ban = create(:ip_ban, category: :full, ip_addr: "1.2.3.4")
         post session_path, params: { name: @user.name, password: "password" }, headers: { REMOTE_ADDR: "1.2.3.4" }