fix(proxy): Harden URI parsing in port forwarding proxy

[skazantsev]

Description of Changes

Harden createProxyRequest in the proxy server patch to use strict input
validation and the WHATWG URL constructor instead of the deprecated
url.resolve() API.

Changes:

• Validate port is a well-formed positive integer (reject leading zeros)
• Normalize leading slash/backslash sequences before constructing the target URL
• Use new URL() with a base URL instead of url.resolve()
• Verify the constructed URL's hostname and port match the intended target

Testing

• Patch applies cleanly via prepare-src.sh
• Dev-build compiles successfully
• Manual verification: legitimate proxied requests (HTML, JS, JSON, nested paths,
  query params, redirects) all work correctly
• Manual verification: malformed path inputs are rejected

Backporting

Needs backport to main, 1.1 and 1.0

---

By submitting this pull request, I confirm that you can use, modify, copy,
and redistribute this contribution, under the terms of your choice.