amp-access: Return url redirect is not validated against Open Redirection Vulnerability

## What's the issue?

The default value of the "return" parameter for the amp-access login endpoint is set to the cdn.ampproject.org ["login done" page](https://github.com/ampproject/amphtml/blob/master/extensions/amp-access/0.1/login-dialog.js#L347) with a "url" parameter that contains the original url of the AMP page, where the canonical backend is supposed to redirect after login or logout. Once redirected, the "login done" page is immediately redirecting back to the URL from the "url" parameter which is the original AMP page from where the authentication request originated from.

The issue is that the "url" parameter is not being validated by the domain, so when the "url" parameter is manually changed to another domain, it's still being redirected to that url and not being validated.

## How do we reproduce the issue?

Let's say this is a valid login page on a site:
https://www.canonical-site.com/login

The AMP default "return" parameter will be set as follows:
https://www.canonical-site.com/login?return=https%3A%2F%2Fcdn.ampproject.org%2Fv0%2Famp-login-done-0.1.html%3Furl%3Dhttps%253A%252F%252Fwww.canonical-site.com%252Famp

The backend of https://www.canonical-site.com should verify the domain from the "return" parameter and block redirects to unknown sites, however, the https://www.canonical-site.com shouldn't need to verify the "url" parameter which is up to the "login done" page, and apparently it doesn't verify the "url" before redirecting.

So if a hacker changes the "url" parameter to some other domain it will still redirect:
https://www.canonical-site.com/signout?return=https%3A%2F%2Fcdn.ampproject.org%2Fv0%2Famp-login-done-0.1.html%3Furl%3Dhttps%253A%252F%252Fwww.github.com

That essentially opens a back door for a Open Redirection Vulnerability on https://www.canonical-site.com when using the AMP login URL system.

This issue relates more to logout since in most cases there's no input required from the user to logout, so it will happen instantly and then redirect.

## What browsers are affected?

All browsers

## Which AMP version is affected?

Probably since amp-access "return" parameter was implemented.