fix: handle invalid Referrer URLs in back() without crashing

[guoyangzhen]

Description

Both redirect() and back() called new URL() without error handling. Invalid URL input (malformed, malicious, or incomplete) would throw an uncaught TypeError and crash the request with a 500 error.

redirect()

// Before
url = new URL(url).toString() // throws on 'https://' or '://invalid'

// After
try {
  url = new URL(url).toString()
} catch {
  // invalid URL, encode as-is
}

back()

// Before
const url = new URL(referrer, this.ctx.href) // throws on invalid Referrer

// After
try {
  const url = new URL(referrer, this.ctx.href)
  if (url.host === this.ctx.host) { ... }
} catch {
  // invalid URL, fall through to alt
}

Impact

Without this fix, a request with Referrer: ://invalid or Location: https:// crashes the entire request handler.