[security] fixed back url verification

--HG--
extra : convert_revision : svn%3Ae93f8b46-1217-0410-a6f0-8f06a7374b81/trunk%4013018
fix protocol-relative redirection test

- escape forward slash in regexp
- allow redirection to home_path '/'
make url redirect tests pass

I don't know why, but the test doesn't pass when both url-tests
are in the same test-method.
When defined in separate test-methods they work fine.
add test for login redirecting to home_url
explicitly allow home path in back_url
using the loop requires logging the user out in-between. using the loop will make it easier to enter more examples.
there was a wrong parenthesis: the last match needs to be ANDed with all the prior checks. instead of changing it, refactored the code to be more clear. still allows redirects to different sub-uris.
Merge pull request #1060 from opf/fix/back_url_verification
Add changelog entry
we don't need to escape the parameters
convert tests to specs to be able to disable them in plugins
Merge pull request #1074 from opf/fix/back_url_verification
given openproject runs in a subdirectory we cannot allow redirecting to a different subdirectory. also tries to catch shenanigans to circumvent the check like ".." in the path.
Fixed wording bug
Merge pull request #1077 from opf/fix/back_url_verification_again
Merge branch 'dev' into dev-angular