fix(proxy): Harden URI parsing in port forwarding proxy

[skazantsev]

Description of Changes

Harden createProxyRequest in the proxy server patch to use strict input
validation and the WHATWG URL constructor instead of the deprecated
url.resolve() API.

Changes:

• Validate port is a well-formed positive integer (reject leading zeros)
• Normalize leading slash/backslash sequences before constructing the target URL
• Use new URL() with a base URL instead of url.resolve()
• Verify the constructed URL's hostname and port match the intended target

Testing

• Patch applies cleanly via prepare-src.sh
• Manual verification on 1.2 build: legitimate proxied requests work, malformed inputs rejected

Additional Notes

Backport of #269 (1.2)

---

By submitting this pull request, I confirm that you can use, modify, copy,
and redistribute this contribution, under the terms of your choice.