fix: preserve double slashes in custom scheme redirect URIs

[gourabsingha1]

Description

This pull request fixes the issue where custom scheme redirect URIs without a path component (e.g. myapp://) are corrupted during OAuth and PKCE verification flow redirects.

Root Cause

Go's standard library net/url parser treats a bare custom scheme without a host (like myapp://) as having an empty host component. When the URL is re-serialized using u.String(), it drops the // authority separator, transforming myapp://?code=xxx into myapp:?code=xxx. Furthermore, http.Redirect parses the target redirect URL and normalizes it using u.String(), causing any manually fixed string URLs to be corrupted again during header construction.

Solution

1. Preserve double slashes in serializations: Refactored prepPKCERedirectURL and prepRedirectURL in internal/api/verify.go to reconstruct and restore double slashes when Go's standard library serialization drops them on empty-host custom schemes.
2. Direct Location header writing: Implemented a new API.redirect helper method that sets the Location header directly on the response writer, bypassing http.Redirect's re-serialization normalization.
3. API Integration: Updated redirects across verify.go, external.go, and samlacs.go to utilize a.redirect.

Fixes #2423