Fix reporting endpoint URL validation on .NET 10 Linux

[Copilot]

Description

On .NET 10 Linux, Uri.TryCreate("/reports", UriKind.Absolute, out _) returns true because the runtime interprets Unix-style paths as file:// URIs. The validator only checked for "absolute" URIs, so relative paths like /reports silently passed validation and OptionsValidationException was never thrown.

Fix: After Uri.TryCreate succeeds, also assert the scheme is http or https:

// Before — passes on .NET 10 Linux for "/reports" (file:///reports)
else if (!Uri.TryCreate(endpoint.Url, UriKind.Absolute, out _))

// After — rejects file://, relative paths, and any non-web scheme
else if (!Uri.TryCreate(endpoint.Url, UriKind.Absolute, out var parsedUrl) ||
         parsedUrl is null ||
         (parsedUrl.Scheme != Uri.UriSchemeHttps && parsedUrl.Scheme != Uri.UriSchemeHttp))

Changed file: src/SafeWebCore/Infrastructure/NetSecureHeadersOptionsValidator.cs

Related Issue

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update

Checklist

• Code follows project coding standards
• Tests added/updated for changes
• All tests pass (dotnet test)
• XML documentation added for public APIs
• CHANGELOG.md updated