Allow oauth2 application redirect_uris to contain wildcards

[glmdev]

Currently, Gitea matches the redirect URI for oauth2 authorize requests against a static list of valid URIs. This causes problems for applications like Gitea-based comments engine Vssue that set the redirect URI to the current page to ensure the user gets redirected to the correct post.

This change introduces a setting called ENABLE_REDIRECT_URI_WILDCARD which, when enabled, causes Gitea to check a redirect URI against the list of allowed URIs using wildcard matching.

Example: http://localhost:4000/blog/post.html is valid if the URI is http://localhost:4000/blog/*

The implementation works by transforming the pattern into a regular expression (e.g. http://localhost:4000/blog/.*) and matching the redirect URI against that expression.

This new setting is disabled by default, which preserves the existing behavior. Closes #9514.

[lunny]

Maybe we can use github.com/gobwas/glob to match which has been in go.mod.

[glmdev]

Sorry for the long delay, but I mentioned this in a reply to wxiaoguang:

Hm. I think the asterisk-only approach is preferable here since there's no way to disable some of the patterns in the glob package. For example, ? is valid in URLs, but in the pattern it would glob to any single character.

[mapreri]

I would also like to see this feature merged.

In my use case, I'd like to use this feature to allow authentication to a set of dynamically-generated subdomains; what we are doing is spawning up testing instances of a company's website in URLs in the form of https://branchname.tests.company.com, and this one feature prevents me from doing it.
I suspect that I could accomplish something similar by updating the oauth2 provider settings via Gitea's API every time I create and delete a subdomain, but this solution of using a wildcard just sounds better to me.

[zeripath]

Hmm... I'm looking at the OAuth2 RFC and specification and this behaviour is explicit disallowed.

https://datatracker.ietf.org/doc/html/rfc6749#section-10.6

I'm kinda concerned about this. Why is Vssue not redirecting back to a standard endpoint, using a cookie or some other mechanism to then redirect the user to the comments page? OAuth2 does not allow people to change the redirect url like this.

https://www.oauth.com/oauth2-servers/redirect-uris/redirect-uri-registration/