fix xss vulnerability in workbench

[tedgargoogle]

Fixes #<issue_number_goes_here>

It's a good idea to open an issue first for discussion.

• Tests pass
• Appropriate changes to documentation are included in the PR

[github-actions]

📋 Review Summary

This Pull Request addresses an XSS vulnerability in the workbench chat interface link renderer by introducing strict origin and relative-path validation rules. The overall design and unit tests are comprehensive and well-structured, successfully blocking a wide range of common bypass methods such as javascript protocols and quote breaking.

🔍 General Feedback

• Excellent Test Coverage: The introduced unit tests cover a wide variety of edge cases (control characters, same-origin vs cross-origin, double-quote escaping), which ensures high regression protection.
• Robust Relative URL Handling: The fallback logic for handling relative paths is robust and handles path structure validations correctly.
• SSR & Security Recommendations: Address the inline comments regarding the SSR origin bypass and CSP compliance to ensure the link renderer is completely secure in all execution environments.