fix: validate OAuth redirect URI against allowlist when strict

[VaibhavAcharya]

- Summary

Part of splitting the Identity security hardening work into reviewable pieces. Stacked on the opt-in flag wiring (#451); depends on its Security.Strict flag.

The OAuth callback resolves its redirect from the request referrer with no validation, so a strict instance can be steered into redirecting (and leaking tokens) to an attacker-controlled URL. This validates the redirect candidate against Security.AllowedRedirectURIs when Security.Strict is set; with the flag off, behavior is unchanged. Entries match by exact scheme and case-insensitive host, with the path matched as a segment prefix (so https://app.example.com/auth allows /auth and /auth/cb but not /authorize); subdomains are not implied. An empty allowlist accepts only the SiteURL host. When nothing matches, the fallback is the operator's first allowlisted entry rather than the raw SiteURL, which would otherwise leak to a non-allowlisted destination.

- Test plan

• go build ./... and go vet ./... pass.
• go test -run 'TestIsAllowedRedirectURI|TestGetExternalRedirectURL_StrictFallbackUsesAllowlist|TestSecurityConfigurationDefaults' ./api/... ./conf/... passes.
• External suite tests need MySQL (hack/mysqld.sh); run go test ./api/... against it.

- Description for the changelog

Validate OAuth redirect URIs against a per-instance allowlist on Identity instances that opt in to strict security.

Link EX-1884

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 0540ef8d-f030-417e-8fda-c6372d1a8dd0

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch vaibhavacharya/ex-1884-identity-oauth-redirect-uri-insufficient-validation-gotrue

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}