Fix open redirect level 1 allowlist validation

[r1kka6]

Summary

• replace the unconditional Level 1 redirect validator with the existing allowlist used by secure levels
• update the Level 1 unit coverage to assert external targets are blocked while /VulnerableApp/ still redirects

Root Cause

getVulnerablePayloadLevel1() passed (url) -> true into the shared redirect helper, so attacker-controlled returnTo values were copied directly into the Location header.

Verification

• docker run --rm -v "$PWD":/workspace -v "$HOME/.gradle":/root/.gradle -w /workspace eclipse-temurin:17-jdk ./gradlew compileJava --no-daemon
• docker run --rm -v "$PWD":/workspace -v "$HOME/.gradle":/root/.gradle -w /workspace eclipse-temurin:17-jdk ./gradlew test --no-daemon
• docker run --rm -v "$PWD":/workspace -v "$HOME/.gradle":/root/.gradle -w /workspace eclipse-temurin:17-jdk ./gradlew spotlessJavaCheck --no-daemon
• runtime: returnTo=https://evil.example now returns 200 with no Location; returnTo=/VulnerableApp/ still returns 302 with Location: /VulnerableApp/