Fix Open Redirect Low same-site validation

[r1kka6]

Summary

• normalize backslashes before evaluating redirect targets
• reject redirects with a parsed scheme or host
• preserve same-site relative redirects used by the challenge

Validation

• docker run --rm -v "$PWD":/app dvwa-ctf-xss-reflected-low php -l /app/vulnerabilities/open_redirect/source/low.php
• docker build -t dvwa-ctf-open-redirect-low .
• vulnerable baseline: GET /vulnerabilities/open_redirect/source/low.php?redirect=https://evil.example/ returned 302 Location: https://evil.example/
• patched image: absolute, protocol-relative, and backslash-host redirects returned 500 with no Location header
• patched image: GET /vulnerabilities/open_redirect/source/low.php?redirect=info.php?id=1 returned 302 Location: info.php?id=1