Fix CI lint failures (gosec G710) and bump dependencies

[patrickdappollonio]

Why

The Testing push workflow uses golangci-lint@latest, and a recent golangci-lint release (2.12.x) added gosec rule G710: open redirect via taint analysis. This broke CI on master (since #249) and on every dependabot branch, which is why all the dependency PRs are blocked.

What

Lint/security fixes — G710 flagged three http.Redirect calls; two were legitimately exploitable (a request path starting with // yields a scheme-relative Location header, e.g. GET //evil.com/index.html → redirect to //evil.com/):

• internal/middlewares/redir_indexes.go and internal/server/handlers.go: collapse duplicate leading slashes before redirecting so the target is always same-origin, then suppress the now-false-positive with justification.
• internal/redirects/redirect.go: placeholder expansion (e.g. :splat) could also turn a local rule destination into //host; same leading-slash collapse applied. The redirect call itself is suppressed with justification since operator-configured rules may intentionally target external URLs.
• Migrated gomodguard → gomodguard_v2 (deprecation warning).

Dependency bumps — supersedes the blocked dependabot PRs #251, #252, #254, #255, #256, #257:

• github.com/yuin/goldmark 1.8.2 → 1.8.4
• golang.org/x/crypto 0.49.0 → 0.52.0 (+ x/sys, x/text via tidy)
• github.com/go-chi/chi/v5 5.2.5 → 5.3.1
• github.com/klauspost/compress 1.18.6 → 1.19.0
• github.com/go-playground/validator/v10 10.30.2 → 10.30.3
• actions/checkout v6 → v7 in all workflows

Verification

• golangci-lint run (2.12.2, same as CI): 0 issues
• go test ./...: all packages pass

🤖 Generated with Claude Code