Fix open redirect (CWE-601) in www-to-apex redirect middleware

[Copilot]

CodeQL alert #16: the www-to-apex redirect middleware constructed the redirect URL via string interpolation, allowing a crafted Path value (e.g. //evil.com/...) to inject an unintended host into the redirect target.

Changes

• Program.cs: Replace free-form string interpolation with UriHelper.BuildAbsolute, which takes scheme and host as discrete typed parameters sourced exclusively from server-side config (siteSettings.BaseUrl), and treats PathBase/Path/QueryString strictly as path/query components.

// Before — user-controlled Path flows into a raw string redirect URL
string redirectUrl = $"{redirectAuthority}{context.Request.PathBase}{context.Request.Path}{context.Request.QueryString}";

// After — scheme and host are config-derived; path components cannot inject a host
string redirectUrl = UriHelper.BuildAbsolute(redirectScheme, redirectHost,
    context.Request.PathBase, context.Request.Path, context.Request.QueryString);