Fix unvalidated URL redirection in HTTP redirects

Use baseurl.Parse to construct the HTTPS redirect URL in the
trust center HTTP handler, breaking the taint chain from raw
request headers. Apply path.Clean to the slug-based redirect
in stripTrustPrefix to normalize path traversal sequences.

Addresses CodeQL go/unvalidated-url-redirection (CWE-601).

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>

pkg/server/server.go

@@ -17,6 +17,7 @@ package server
 import (
 	"errors"
 	"net/http"
+	"path"
 	"strings"
 
 	"github.com/go-chi/chi/v5"
@@ -156,7 +157,8 @@ func (s *Server) stripTrustPrefix(next http.Handler) http.Handler {
 		prefix := "/trust/" + slugOrId
 
 		if r.URL.Path == prefix {
-			http.Redirect(w, r, prefix+"/", http.StatusMovedPermanently)
+			cleanPath := path.Clean(prefix) + "/"
+			http.Redirect(w, r, cleanPath, http.StatusMovedPermanently)
 			return
 		}