Validate RelayState for SLO redirects

[gerardo-navarro]

This pull request enhances the security of SAML Single Logout (SLO) relay state handling by introducing strict validation to prevent open redirect vulnerabilities. It ensures that only safe, relative paths are accepted as relay states, falling back to a default value when unsafe input is detected. Comprehensive tests have been added to verify this behavior.

Security improvements:

• Added a validate_relay_state method in lib/omniauth/strategies/saml.rb to ensure that only safe, relative paths (starting with / and without a scheme or host) are accepted as relay states, rejecting protocol-relative, absolute URLs, and JavaScript URIs. Unsafe relay states default to a safe value. [1] [2]
• Updated slo_relay_state logic to use the new validation, falling back to a default relay state when the provided value is unsafe.
• Required the uri library for proper URI parsing and validation.

Testing improvements:

• Updated and expanded tests in spec/omniauth/strategies/saml_spec.rb to check that unsafe relay states (absolute URLs, protocol-relative URLs, and JavaScript URIs) are rejected and the default relay state is used instead. [1] [2] [3] [4]