force_ssl doesn't respect the format of the original request (3-2-stable)

`force_ssl` won't take the format of the original request into account, as a result redirecting to a format-less URL.

This patch is almost exact as #9061 on the 4-2-stable branch, but I think this is a critical issue and should be fixed in the older supported versions as well.

There's a fix with a test as well as a separate commit refactoring how redirect URL is constructed.