Function validateRedirect

Validates that the given URL is acceptable as a post-login redirect target.

Rules:

• Must be ≤ 2048 characters.
• Must be a valid absolute URL with http: or https: scheme.
• If sessionDomain is configured, the URL hostname must match or be a subdomain of the normalised domain (leading dot stripped).