Potential fix for code scanning alert no. 44: Server-side request forgery

[cindiekinzz-coder]

Potential fix for https://github.com/cindiekinzz-coder/NESTstack/security/code-scanning/44

General fix: never concatenate user-controlled full URLs (or raw request URLs) into outbound request targets. Instead, construct the target with new URL() from a trusted base URL, and append only validated route/path/query components.

Best fix here (without changing intended functionality): in the /v1/{*path} proxy block, replace const target = \${openclawUrl}${req.originalUrl}`;` with URL-safe construction:

• Use req.params.path (route-captured wildcard) instead of req.originalUrl.
• Normalize and strip leading slashes from the captured path.
• Build URL via new URL(base) and set pathname and search explicitly.
• Keep method/body behavior as-is.

This change is in NESTdesktop/local-agent.js, around lines 440–445.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.