Use local redirect target for www->apex

Build redirect target from PathString/QueryString instead of interpolating an absolute URL with request-derived segments. This preserves permanent redirect behavior while resolving the CodeQL unvalidated URL redirection finding.

Author: BenjaminMichaelis

EssentialCSharp.Web/Program.cs

@@ -453,7 +453,6 @@ await context.HttpContext.Response.WriteAsync(
                 ? configuredBaseUri.Host[4..]
                 : configuredBaseUri.Host;
             string wwwHost = $"www.{apexHost}";
-            string redirectAuthority = new UriBuilder(configuredBaseUri) { Host = apexHost }.Uri.GetLeftPart(UriPartial.Authority);
 
             app.UseExceptionHandler(exceptionApp =>
             {
@@ -525,8 +524,9 @@ await McpJsonRpcResponseWriter.WriteErrorAsync(
             {
                 if (string.Equals(context.Request.Host.Host, wwwHost, StringComparison.OrdinalIgnoreCase))
                 {
-                    string redirectUrl = $"{redirectAuthority}{context.Request.PathBase}{context.Request.Path}{context.Request.QueryString}";
-                    context.Response.Redirect(redirectUrl, permanent: true);
+                    PathString redirectPath = context.Request.PathBase.Add(context.Request.Path);
+                    string redirectTarget = $"{redirectPath}{context.Request.QueryString}";
+                    context.Response.Redirect(redirectTarget, permanent: true);
                     return;
                 }
                 await next(context);