fix: resolve relative URLs in chrome.windows.create

[iamEvanYT]

Resolves relative URLs so apps can open the correct URLs.
Also aligns behavior with packages/electron-chrome-extensions/src/browser/api/tabs.ts

Before, createWindow implementation receives: { incognito: false, url: 'session-buddy.html' }
After, createWindow implementation receives: { incognito: false, url: 'chrome-extension://edacconmaakjimmfgnblocblbcdcpbko/session-buddy.html' }

---

✅ By sending this pull request, I agree to the Contributor License Agreement of this project.

[kauri-hero]

Nice to see this @iamEvanYT 🤝
We hit this exact bug migrating MASQ Browser (Electron 38) from an older fork (before the service-worker and MV3 support was merged into Electron) onto stock v4.9.0 — MV3 wallet extensions open their detached signing windows via chrome.windows.create with a relative URL (e.g. Rabby's notification.html), which reaches impl.createWindow unresolved and renders a blank window (ERR_ABORTED).

We independently arrived at the same fix (hoist validateExtensionUrl to common.ts, apply in WindowsAPI.create mirroring tabs.create) and have been running it in a stable staging build as a package patch: verified end-to-end with Rabby 0.93.82 and MetaMask (MV2 11.16.5 + MV3 13.38) signing flows.
+1 for merging — happy to help test!

(We're a Patron-licensed user. One adjacent gap we'll file separately: createWindowDetails hardcodes type: 'normal', which breaks many MV3 extensions with self-closing windows — it guards on windows.getCurrent().type === 'popup'.)