Security: Add URL validation and logging for unsanitized URLs

[coderabbitai]

Background

When URL sanitization is disabled (introduced in #80), we should still implement basic security measures:

1. Add basic URL validation for unsanitized redirect URLs
2. Add logging when URL sanitization is bypassed

References

• Original discussion: feat: Add option to disable url sanitation #80 (comment)

Requirements

• Implement basic URL validation using URL constructor
• Add warning logs when sanitization is bypassed
• Handle invalid URLs appropriately with clear error messages

/cc @DanielRivers