Add support for validating HTTP redirection destinations in response "Location" headers, similar to BIG-IP ASM Redirection Protection / Allowed Redirection Domains.

Desired behavior:

• Inspect HTTP 30x responses containing a "Location" header.

• Allow relative redirects.

• Allow absolute redirects only to configured domains / domain patterns.

• Support learning or logging-only mode before enforcement.

• Generate a distinct security event when a redirect target falls outside the configured allowlist.

• Support per-load-balancer or per-policy configuration.

This would provide parity with the older BIG-IP ASM control for mitigating open/unvalidated redirect behavior at the WAF layer.

The use case is not a primary application-security control, but it is a useful defense-in-depth capability for applications that legitimately perform external redirects, particularly SSO-enabled applications.