Prevent arbitrary redirects through `redir_url` on short links

Summary

The public redirect handler currently allows the redir_url query parameter to replace the destination stored for a short link. This means a valid short link can be used to send visitors to an arbitrary external URL.

Impact

This creates an open-redirect risk that could be abused for phishing and misleading link attribution.

Reproduction

Request a valid short link with a redir_url parameter pointing to an unrelated external domain. The response currently uses that parameter as the Location target instead of the stored short-link destination.

Proposed fix

Keep the stored short-link destination authoritative and ignore untrusted redir_url overrides. A regression test should verify that an attacker-controlled value cannot replace the stored destination.

A prepared fix and regression test are available in my fork branch: Sudaisib/dub:fix/4337-untrusted-redirection-url.