Validate session transfer redirect with saferedirect

The session transfer handler was blindly redirecting to the continue URL
from the signed token. Use saferedirect with a trust center domain check
to prevent open redirects, and only trigger session transfer for known
trust center custom domains instead of any non-base-URL host.

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

pkg/server/api/connect/v1/oidc_handler.go

@@ -176,7 +176,7 @@ func (h *OIDCHandler) buildSessionTransferURL(ctx context.Context, redirectURL s
 
 	token, err := authn.SignSessionTransfer(sessionID, redirectURL, h.cookieSecret)
 	if err != nil {
-		h.logger.Error("cannot sign session transfer token", log.Error(err))
+		h.logger.ErrorCtx(ctx, "cannot sign session transfer token", log.Error(err))
 		return "", false
 	}