[server/auth] ensure safe returnTo param

[AlexTugarev]

This PR closes an open redirect issue. AFAIK this is problem if an attacker would fake a Gitpod-like website and make people use links with redirects to it. The fake website could potentially ask user to enter sensitive information.

Allowing for Gitpod homepage URLs comes in parallel via #2692. ✔️

how to test

0. log in & log out without errors.
1. should login and start a workspace: http://at-returnto.staging.gitpod-dev.com/api/#?host=github.com&returnTo=http://at-returnto.staging.gitpod-dev.com/#https://github.com/gitpod-io/django-locallibrary-tutorial
2. log out.
3. should open the dashboard: http://at-returnto.staging.gitpod-dev.com/api/#?host=github.com&returnTo=https://github.com/gitpod-io/gitpod/pull/2879

[csweichel]

works as advertised. LGTM.

[AlexTugarev]

Thanks for reporting, @payloadartist! 🙏🏻

Just created an update #4567 to be picked up for https://www.gitpod.io/changelog soon.

[payloadartist]

Thanks for reporting, @payloadartist! 🙏🏻

Just created an update #4567 to be picked up for https://www.gitpod.io/changelog soon.

FYI you can credit me with my Twitter handle - https://twitter.com/payloadartist in the changelog if you want

As I already see someone credited for a security vuln

[payloadartist]

This was assigned CVE-2021-35206 btw

Thanks