[Bug] Missing URL validation for "Avatar External Provider URL and Room Avatar External Provider URL" settings allows invalid strings

Description:

The "Avatar External Provider URL" and "Room Avatar External Provider URL" input fields in the Administration settings currently accept arbitrary text strings. There is no validation to ensure the input follows a valid URL format (e.g., starting with http:// or https://), despite the helper text displaying a URL pattern.

This allows admins to accidentally save invalid configurations, which leads to broken image links when the system attempts to fetch avatars from the invalid path.

Steps to Reproduce:

1.Log in as an Administrator.

2.Navigate to Administration -> Settings.

3.Go to the Accounts section search for Avatar section navigate to ( "Avatar External Provider " and "Room Avatar External Provider URL") .

4.Locate the Avatar External Provider URL field and "Room Avatar External Provider URL" .

5.Enter a non-URL string (e.g., random text here or test.com without protocol).

Click Save Changes.

Expected Behavior:

The system should validate the input format.
Ideally: Real-time validation should prevent the user from saving if the format does not match a URL pattern (Regex check).
Minimum: The UI should display an error message (e.g., "Please enter a valid URL starting with http/https") and disable the Save action.

Actual Behavior:

The system accepts the invalid string and saves the changes successfully without any warning or error message.

Server Setup Information:

• Version of Rocket.Chat Server: develop
• License Type: community
• Number of Users: 1
• NodeJS Version: 22.16.0
• MongoDB Version:6.10.0

Client Setup Information:

• Desktop App or Browser Version: chrome(latest)
• Operating System: windows

Root Cause:

It appears the input field is likely set to a standard type="text" without a regex pattern match or schema validation.

Suggested Fix:

Update the input component to include a pattern validation check before submission. For example, ensuring the string matches a standard URL regex
^(https?|ftp)://[^\s/$.?#].[^\s]*$

Screenshots:

Start in Administration → Settings, under Accounts and the Avatar External Provider URL and Room Avatar External Provider URL fields, and reproduce the invalid-input save behavior. Verify that valid HTTP or HTTPS URLs remain accepted, while invalid strings show an error and cannot be saved.