fix: Critical/High XSS and open redirect vulnerabilities (no data migration)

[Copilot]

User-controlled fields were injected raw into Vue.js data initialization blocks, enabling stored XSS. Payment and download redirect URLs lacked protocol validation, enabling javascript:/data: URI injection.

XSS — Html.Raw() in JavaScript context (7 views)

Fields like FirstName, Email, Address, Enquiry etc. were embedded in JS string literals without encoding:

// Before — XSS: FirstName: 'Smith\', XSS=alert(1)//'
FirstName: '@Html.Raw(Model.FirstName)',

// After — safe JSON encoding
FirstName: @Json.Serialize(Model.FirstName),

Affected views: Account/Info, Account/Register, Account/Partials/EditSubAccount, Account/Partials/CreateSubAccount, Contact/Index, Shared/Partials/CreateOrUpdateAddress, MerchandiseReturn/MerchandiseReturn.

Open Redirect — payment & download URLs (3 controllers)

PostRedirectPayment() and stored download URLs were redirected to without scheme validation. Added Uri.TryCreate + http/https-only guard — payment provider external URLs continue to work.

// Before
return Redirect(redirectUrl);

// After
if (Uri.TryCreate(redirectUrl, UriKind.Absolute, out var uri) &&
    (uri.Scheme == Uri.UriSchemeHttp || uri.Scheme == Uri.UriSchemeHttps))
    return Redirect(redirectUrl);

Affected: OrderController.RePostPayment, CheckoutController.CompleteRedirectionPayment, DownloadController.DownloadFile.

No data migration required. No changes to Grand.Web.Store.CustomerController.