fix: resolve redirect URI security vulnerability

[swalker326]

Summary

• port the redirect URI validation fix from Fix redirect URI security vulnerability and improve documentation anomalyco/openauth#305 into our fork
• preserve the upstream behavior change that returns HTTP 400 for invalid or malformed redirect URIs instead of redirecting back to them
• add the upstream regression tests covering malformed redirect URIs, forwarded host handling, and same-request error behavior

Validation

• bun test packages/openauth/test/issuer.test.ts packages/openauth/test/redirect-uri-validation.test.ts
• bun run test

Credit

• Original patch by @niklaswallerstedt in Fix redirect URI security vulnerability and improve documentation anomalyco/openauth#305