Fix Referer header validation bypass via URL normalization

[Copilot]

The Referer header whitelist used exact string matching, allowing trivial bypasses by appending query parameters or fragments. An attacker could access restricted embeds by visiting https://allowed-site.com/article?bypass=1 instead of the whitelisted https://allowed-site.com/article.

Changes

• URL normalization function: Parses URLs and compares only scheme://host/path, stripping query parameters, fragments, and trailing slashes
• Scheme restriction: Only http/https accepted; rejects file://, javascript:, data:, etc.
• Host validation: Requires valid host, no empty host strings
• Applied to all whitelist operations: Referer validation, whitelist add/remove

Example

// Before: exact match required
"https://medium.com/@user/article" == "https://medium.com/@user/article?bypass=1"  // false ❌

// After: normalized comparison
normalize_url("https://medium.com/@user/article?bypass=1")  // "https://medium.com/@user/article" ✓
normalize_url("https://medium.com/@user/article#fragment") // "https://medium.com/@user/article" ✓
normalize_url("file:///etc/passwd")                         // None (rejected) ✓

Logging added for failed normalization attempts. Error messages clarify rejection reasons.

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.