RedirectCommand does not have open redirect protection

Background information

This was originally reported as a private security issue, but has been approved for handling in the public queue by the Drupal Security Team.

• security.drupal.org private issue: https://git.drupalcode.org/security/185102-drupal-security/-/work_items/1
  (included for reference. Please do not report access denied as an error.)

Problem/Motivation

RedirectResponseSubscriber prevents redirect responses from redirecting to untrusted URLs.
For example this is not allowed:

  public function test() {
    return new RedirectResponse('http://example.com');
  }

But this works:

  public function test() {
    $response = new AjaxResponse();
    $response->addCommand(new RedirectCommand('http://example.com'));

    return $response;
  }

Steps to reproduce

Proposed resolution

Remaining tasks

User interface changes

Introduced terminology

API changes

Data model changes

Release notes snippet