Accept a site-relative step_up_login_url

Problem/Motivation

The assurance method's step_up_login_url must be an absolute http(s) URL: BridgeController::trustedStepUpLoginUrl() requires a ^https?:// prefix and StepUpAuthorizeUrl::build() rejects non-absolute bases. When the integrating site provides its own step-up initiator route (a server-side page that starts the IdP authorize flow), the natural value is a site-relative path like /wl-oidc/step-up — but the current validation forces a per-environment absolute URL into what is otherwise environment-neutral exported configuration.

Proposed resolution

Accept a site-relative step_up_login_url in both places: a path starting with a single "/" (reject "//" network-path references, backslashes, and anything else) is same-origin by construction, so the existing open-redirect defense is not weakened — the query-supplied login_url stays ignored, exactly as today. StepUpAuthorizeUrl::build() appends acr_values to a relative base the same way it does to an absolute one. Absolute https URLs keep working unchanged.

User interface changes

The step_up_login_url form description mentions that a site-relative path is accepted.

Remaining tasks

Development happens on the project's GitHub repository (Wilkes-Liberty/file_gate); the PR will be cross-linked here for review. Kernel test coverage: relative path accepted with acr appended; "//evil.example" and "javascript:" rejected.