Neutralize unsafe (non-local) destination params

[olivierlacan]

This addresses a cover redirect vulnerability when the following is used as an
authentication URL:

http://domain.dev/auth/provider?destination=//google.com

Covert redirects (https://www.owasp.org/index.php/Open_redirect) are often used
in phishing scams by giving people a link that appears save but surreptitiously
redirects them to a different domain.

Once on that different domain (which can be designed to look like the original
domain), users can be asked their password and give it away because they don't
notice that they have been redirected to a different destination.

This is not a vulnerability in itself, but used in combination with a rather
simple phishing attack, this can be potentially dangerous.

PS: I previously tried to fix this on OmniAuth::Strategy but it is specific to OAuth 2 and all strategies that override the request_phase method defeat my original fix. That said I don't know if this is the ideal place
to fix this. It's just something I've tested and works for all our strategies that inherit from OmniAuth::Strategies::OAuth2: omniauth-github, omniauth-facebook, and omniauth-gplus.

[olivierlacan]

Haven't included tests for this yet. Just let me know if this mergeable and I'll add them.

[olivierlacan]

Not sure what these build errors are about to be honest: https://travis-ci.org/intridea/omniauth-oauth2/jobs/92181807#L155

[olivierlacan]

Just realized callback_url is actually returning the original request.query_string so what I'm doing here is being ignored.

[olivierlacan]

Feels like I should close this and open a PR on omniauth itself to either add the fix as it is or add a new config to disable unsafe redirects on redirect_uri. Curious what you think @sferik. Is this a fool's errand?