[Security] Unicode normalization can lead to open redirect

# Description

We are facing the following behaviour , we have the following endpoint that returns a redirect response via :

```return Response.seeOther("https://www.google.com☣@example.org");```
Normally this should redirect the user to `example.org`, however it is not the case the redirection goes to `www.google.com` .

You can use any unicode character that ends with 23 (e.g `\u2523`), jakarta will do some sort of normalization in the response headers and convert the unicode character to a literal # causing the legitimate domain to be interpreted as fragment.

# Problem

This is a big problem when having an Oauth endpoint using jakarta, the normal implementation would be to take redirect_uri from User input and validate the host, and then redirect to the target domain. The problem here is when parsing this redirect uri in java "[https://www.malicious.com☣@legitimate.com](https://www.malicious.com%E2%98%A3@legitimate.com/)" the host will be legitimate.com but the redirection via `seeOther()` will send the user to malicious.com, which will result in an open redirect in oauth flows.