fix(lib): close open redirect when in subrequest mode

[Xe]

Closes GHSA-cf57-c578-7jvv

Previously Anubis had an open redirect in subrequest auth mode due to an insufficent fix in GHSA-jhjj-2g64-px7c. This patch adds additional validation at several steps of the flow to prevent open redirects in subrequest auth mode as well as implements automated testing to prevent this from occuring in the future.

Checklist:

• Added a description of the changes to the [Unreleased] section of docs/docs/CHANGELOG.md
• Added test cases to the relevant parts of the codebase
• Ran integration tests npm run test:integration (unsupported on Windows, please use WSL)
• All of my commits have verified signatures

[Xe]

lol anubis tests just failed because of the Azure outage:

 W: Failed to fetch https://packages.microsoft.com/repos/azure-cli/dists/noble/InRelease  Temporary failure resolving 'packages.microsoft.com'
W: Failed to fetch https://packages.microsoft.com/ubuntu/24.04/prod/dists/noble/InRelease  Temporary failure resolving 'packages.microsoft.com'
W: Some index files failed to download. They have been ignored, or old ones used instead.
Error: listen EADDRINUSE: address already in use :::9001
--- FAIL: TestPlaywrightBrowser (114.72s)
    playwright_test.go:222: running command: npx --yes [email protected] install --with-deps
    playwright_test.go:222: daemonizing command: npx --yes [email protected] run-server --port 9001
    playwright_test.go:576: could not install Playwright: could not install driver: could not install driver: could not download driver from https://playwright.azureedge.net/builds/driver/playwright-1.52.0-linux.zip: Get "https://playwright.azureedge.net/builds/driver/playwright-1.52.0-linux.zip": dial tcp: lookup playwright.azureedge.net on 127.0.0.53:53: read udp 127.0.0.1:34657->127.0.0.53:53: i/o timeout
        could not download driver from https://playwright-akamai.azureedge.net/builds/driver/playwright-1.52.0-linux.zip: Get "https://playwright-akamai.azureedge.net/builds/driver/playwright-1.52.0-linux.zip": dial tcp: lookup playwright-akamai.azureedge.net on 127.0.0.53:53: read udp 127.0.0.1:34522->127.0.0.53:53: i/o timeout
        could not download driver from https://playwright-verizon.azureedge.net/builds/driver/playwright-1.52.0-linux.zip: Get "https://playwright-verizon.azureedge.net/builds/driver/playwright-1.52.0-linux.zip": dial tcp: lookup playwright-verizon.azureedge.net on 127.0.0.53:53: read udp 127.0.0.1:48405->127.0.0.53:53: i/o timeout

[Xe]

Overriding to merge and fix.