Audits Should Not Follow URL Outside Of Domain

Currently audits follow the baseURL to its final URL even if outside of the site's (www?.) domain. This leads to situations where instead of the site an external site, e.g. an authentication provider, is audited. The URL resolver should return an error if we get outside the site's domain.

Locate the URL resolver used when audits follow baseURL, then trace how it determines the site's (www?.) domain and handles redirects. Reproduce a redirect to an external authentication provider and verify that the resolver returns an error instead of auditing the external site.

Written by the indexing model from the issue text.