check that an FQDN belongs to a known app before redirecting to it

[capnspacehook]

See https://github.com/gravitational/teleport-private/issues/1418 on how to test this.

Fixes https://github.com/gravitational/teleport-private/issues/1492, updates https://github.com/gravitational/teleport-private/issues/1418.

changelog: prevent redirects to arbitrary URLs when launching an app

[public-teleport-github-review-bot]

@capnspacehook See the table below for backport results.

Branch	Result
branch/v14	Create PR
branch/v15	Create PR
branch/v16	Create PR

[marcoandredinis]

This might have break AWS App Access when using an Integration
The app_server that exists looks like this

kind: app_server
metadata:
  name: teleportdev
spec:
  app:
#...
    spec:
      integration: teleportdev
      public_addr: teleportdev.dinis.cloud.gravitational.io:443
      uri: https://console.aws.amazon.com
#...
version: v3

When I click to open the AWS Console, I can see that at first the url looks like this

https://dinis.cloud.gravitational.io/web/launch/teleportdev.dinis.cloud.gravitational.io:443/dinis.cloud.gravitational.io/teleportdev.dinis.cloud.gravitational.io:443/arn:aws:iam::123456789012:role%2FMarcoTestReadOnlyAccess

But then, it loses the port in the URL right after /launch/ when generating the 2nd URL (the one that has the state)