This PR fixes three security issues in @feathersjs/authentication-oauth:

• Open redirect via URL authority injection - The redirect query parameter was concatenated to the base origin without
  validation, allowing attackers to steal access tokens via URLs like https://target.com@attacker.com#access_token=secret
• Origin validation bypass - The startsWith() check allowed attackers to bypass origin validation by registering
  domains like target.com.attacker.com when origin configuration does not end with /
• Internal headers exposure - All HTTP request headers were stored in the session cookie (which is signed but not
  encrypted), could leak proxy headers like X-Forwarded-For or internal API keys

🤖 Co-created with https://claude.com/claude-code