Fix compliance page login redirect to custom domains

SafeRedirect previously matched against a single static host string,
so OIDC callbacks always fell back to the console instead of
redirecting back to compliance pages on custom domains. Refactor
AllowedHost into a dynamic AllowedHostFunc and wire a trust-service
lookup into the connect handler so custom domain hosts are accepted.

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

pkg/server/api/trust/v1/v1_resolver.go

@@ -193,10 +193,10 @@ func (r *mutationResolver) SendMagicLink(ctx context.Context, input types.SendMa
 
 	baseURL := compliancepage.CompliancePageBaseURLFromContext(ctx)
 
-	safeRedirect := &saferedirect.SafeRedirect{AllowedHost: baseurl.MustParse(*baseURL).Host()}
+	safeRedirect := saferedirect.New(saferedirect.StaticHosts(baseurl.MustParse(*baseURL).Host()))
 
 	if input.Continue != nil {
-		_, ok := safeRedirect.Validate(*input.Continue)
+		_, ok := safeRedirect.Validate(ctx, *input.Continue)
 		if !ok {
 			return nil, gqlutils.Invalidf(ctx, "invalid continue URL")
 		}