fix: DAH-3216 Add redirect allowlist

[chadbrokaw]

Description

This PR introduces a redirect_url allowlist that will only permit redirects to either the my account or reset password pages.

Jira ticket

https://sfgovdt.jira.com/browse/DAH-3216

Before requesting eng review

Version Control

• branch name begins with angular if it contains updates to Angular code
• branch name contains the Jira ticket number
• PR name follows type: TICKET-NUMBER Description format, e.g. feat: DAH-123 New Feature. If the PR is urgent and does not need a ticket then use the format urgent: Description

Code quality

• the set of changes is small
• all automated code checks pass (linting, tests, coverage, etc.)
• code irrelevant to the ticket is not modified e.g. changing indentation due to automated formatting
• if the code changes the UI, it matches the UI design exactly

Review instructions

• instructions specify which environment(s) it applies to
• instructions work for PA testers
• instructions have already been performed at least once

Request eng review

• PR has needs review label
• Use Housing Eng group to automatically assign reviewers, and/or assign specific engineers
• If time sensitive, notify engineers in Slack

Before merging

Request product acceptance testing

• Code change is behind a feature flag
• If code change is not behind a feature flag, it has been PA tested in the review environment (use needs product acceptance label to indicate that the PR is waiting for PA testing)