Redirect_URI allowlist

Currently, the plugin only supports redirect_uris on the same domain as the client_id. The spec calls for having the client_id have a allowlist of acceptable redirect_uris that can be polled. This is not yet supported.

@aaronpk alternatively alllows this to be overridden by issuing a warning in the authorization screen, as opposed to what the plugin does, which is reject it.

https://indieauth.spec.indieweb.org/#redirect-url

Start by tracing the plugin's redirect_uri validation and the authorization screen behavior, then compare them with the redirect URL section of the linked IndieAuth specification. Done means acceptable redirect URIs can be determined from the client_id allowlist, with the specified warning or rejection behavior applied consistently.

Written by the indexing model from the issue text.