Assurance step-up open redirect via login_url query param

Problem/Motivation

Assurance step-up may set login_url from field config, but the step-up page also trusts any login_url query param and does location.href = loginUrl + …return_to=… (BridgeController).

An attacker can craft a step-up URL that sends the victim to an external phishing page with a return_to back to the legitimate origin.

Severity is high for assurance deployments that enable step-up login; medium if step-up is unused.

GitHub: Wilkes-Liberty/file_gate#40.

Steps to reproduce

1. Enable assurance with step-up login configured on a field.
2. Open the step-up page with a crafted login_url=https://evil.example/ query parameter.
3. Observe redirect / navigation to the attacker-controlled URL (with return_to appended).

Proposed resolution

Ignore query login_url. Only use field step_up_login_url after loading gate settings for f=.

Remaining tasks

• Reject / ignore arbitrary query login_url
• Keep field-configured step-up login working
• Negative Kernel (or unit) test
• Dual-venue status updated on ship

API changes

Query param login_url no longer honored (breaking only for callers that relied on the unsafe override).

Data model changes

None.