Remove assertActivityMatchesUrls in favor of three-way same-authority checks (resolves #956 and #914)

What does this MR do?

Removes the assertActivityMatchesUrls function in favor of new logic that uses multiple same-authority checks to limit redirects. First, signedGet or getActivityJson calls into ApUtilityService.assertIdMatchesUrlAuthority to check that the response id matches the final response URL. Then, Resolver.resolve calls the same method to verify id against the original input URL. If all checks pass, then all three URLs must have the same authority.

This guarantees that id is valid and no cross-authority redirects took place, but increases the chance of an invalid url causing Person or Note validation errors. To avoid this, all url checks are replaced with calls to ApUtilityService.findSameAuthorityUrl to find the first matching entry in the url array, Link, or string. If no inputs match, then the value of url is ignored and we fall back to using the validated uri instead.

With these changes in place, validation of id, uri, and url is slightly relaxed. In combination with the pre-fetch redirect check in ap/show.ts, the Lookup function can now follow redirects and resolve to alternate URIs on the same domain.

Contribution Guidelines

By submitting this merge request, you agree to follow our Contribution Guidelines

• I agree to follow this project's Contribution Guidelines
• I have made sure to test this merge request