Revert "fix: prevent OAuth parameter injection via returnTo (#2381) (#2413)"

[tusharpandey13]

This reverts commit 50d25c1, essentially reverting the PR #2413.

Reason: Incorrect attribution was provided in the rebased PR.

A PR with the correct attribution will follow this change.
Reverted UTs can be added in a seperate PR.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.56%. Comparing base (b128e0d) to head (6a43935).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2441   +/-   ##
=======================================
  Coverage   90.56%   90.56%           
=======================================
  Files          39       39           
  Lines        4515     4515           
  Branches      932      933    +1     
=======================================
  Hits         4089     4089           
  Misses        420      420           
  Partials        6        6           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[semgrepcode-auth0]

Semgrep identified an issue in your code:
Potential OAuth parameter injection vulnerability detected. A redirect parameter is being used in URL construction without proper encoding. An attacker could inject additional OAuth parameters (e.g., &prompt=login, &scope=openid) to manipulate the authentication flow. Use encodeURIComponent() to properly encode the value.

To resolve this comment:

✨ Commit Assistant fix suggestion

Suggested change

	`${config.loginUrl}${opts.returnTo ? `?returnTo=${returnTo}` : ""}`
	`${config.loginUrl}${opts.returnTo ? `?returnTo=${encodeURIComponent(returnTo)}` : ""}`

View step-by-step instructions

1. Import encodeURIComponent if it's not already available (it's a built-in JavaScript function, so no import needed).
2. Wrap the returnTo variable with encodeURIComponent() in the template string: change ?returnTo=${returnTo} to ?returnTo=${encodeURIComponent(returnTo)}.
   This prevents attackers from injecting additional OAuth parameters like &prompt=login or &scope=openid by properly encoding special characters in the redirect URL.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by oauth-parameter-injection-via-redirect.

_{You can view more details about this finding in the Semgrep AppSec Platform.}

[tusharpandey13]

This can be skipped for now since this fix will be pushed in a separate PR