Restrict OAuth client branding URLs to http(s)

CIMD and registration accepted any URI scheme for client_uri and
logo_uri, so allowlisted metadata could surface javascript: links on
sign-in. Validate absolute http/https at ingest and only expose those
schemes in branding.

Signed-off-by: Bryan Frimin <bryan@probo.com>

pkg/coredata/oauth2_client.go

@@ -647,12 +647,26 @@ func NewCIMDClient(
 	}
 
 	if logoURI != nil && *logoURI != "" {
-		u := uri.URI(*logoURI)
+		u, err := uri.Parse(*logoURI)
+		if err != nil {
+			return nil, fmt.Errorf("cannot parse logo_uri: %w", err)
+		}
+		if !u.IsHTTP() {
+			return nil, fmt.Errorf("logo_uri must be an absolute http or https URL")
+		}
+
 		client.LogoURI = &u
 	}
 
 	if clientURI != nil && *clientURI != "" {
-		u := uri.URI(*clientURI)
+		u, err := uri.Parse(*clientURI)
+		if err != nil {
+			return nil, fmt.Errorf("cannot parse client_uri: %w", err)
+		}
+		if !u.IsHTTP() {
+			return nil, fmt.Errorf("client_uri must be an absolute http or https URL")
+		}
+
 		client.ClientURI = &u
 	}