Restrict OAuth client branding URLs to http(s)

CIMD and registration accepted any URI scheme for client_uri and
logo_uri, so allowlisted metadata could surface javascript: links on
sign-in. Validate absolute http/https at ingest and only expose those
schemes in branding.

Signed-off-by: Bryan Frimin <bryan@probo.com>

pkg/iam/oauth2/service.go

@@ -1103,6 +1103,24 @@ func (s *Service) RegisterClient(
 		}
 	}
 
+	if req.ClientURI != nil && !req.ClientURI.IsHTTP() {
+		return gid.Nil,
+			"",
+			NewError(
+				ErrInvalidRequest,
+				WithDescription("client_uri must be an absolute http or https URL"),
+			)
+	}
+
+	if req.LogoURI != nil && !req.LogoURI.IsHTTP() {
+		return gid.Nil,
+			"",
+			NewError(
+				ErrInvalidRequest,
+				WithDescription("logo_uri must be an absolute http or https URL"),
+			)
+	}
+
 	var (
 		plaintextSecret string
 		secretHash      []byte