Fix an open redirection vulnerability in the `http.server` module when
an URI path starts with `//`.  Vulnerability discovered, and initial fix
proposed, by Hamza Avvan.

Test authored and secondary mitigation by Gregory P. Smith [Google].

make the base urls, attack urls, and expected_location more clear in the
test.  Adds an additional test for a triple-slash path to ensure we're
not only treating double slashes as special.

Remove the send_head scheme & netloc neutering that I had added.
Unnecessary in the primary issue's case and actually causes a problem
in this other potential case.  It's unclear how often any clients
ever send an absolute-URI to a http server instead of a relative-URI
but as it works today we shouldn't break that.

Adds a test for the non-attack as a starting all-ok check.
Makes the absolute scheme://netloc request-uri case more lenient
as all we care about there is that the scheme://netloc makes it
into the Location: header in that scenario.