push down url validation to avoid security check false alarm

[lxning]

Description

Please read our CONTRIBUTING.md prior to creating your first pull request.

Please include a summary of the feature or issue being fixed. Please also include relevant motivation and context. List any dependencies that are required for this change.

The url validation is already done before we use the url. There is false security alarm b/c security check lost the context. To avoid the false alarm, we push down url validation.

Fixing:

1. disable loading TS_ALLOWED_URLS from env
2. move url validation close to "new URL(url)" to clearly show security false positive"
3. sanity check archiveName to guard Uncontrolled data used in path expression

Fixes #(issue)
#2665

Type of change

Please delete options that are not relevant.

• Bug fix (non-breaking change which fixes an issue)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• New feature (non-breaking change which adds functionality)
• This change requires a documentation update

Feature/Issue validation/testing

Please describe the Unit or Integration tests that you ran to verify your changes and relevant result summary. Provide instructions so it can be reproduced.
Please also list any relevant details for your test configuration.

• Test A
  Logs for Test A

• Test B
  Logs for Test B

Checklist:

• Did you have fun?
• Have you added tests that prove your fix is effective or that this feature works?
• Has code been commented, particularly in hard-to-understand areas?
• Have you made corresponding changes to the documentation?

[codecov]

Codecov Report

Merging #2685 (941171a) into master (f57240f) will not change coverage.
Report is 1 commits behind head on master.
The diff coverage is n/a.

❗ Current head 941171a differs from pull request most recent head 378dd50. Consider uploading reports for the commit 378dd50 to get more accurate results

@@           Coverage Diff           @@
##           master    #2685   +/-   ##
=======================================
  Coverage   72.39%   72.39%           
=======================================
  Files          85       85           
  Lines        3956     3956           
  Branches       58       58           
=======================================
  Hits         2864     2864           
  Misses       1088     1088           
  Partials        4        4           

📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more

let's run the code scanner after rebasing or merging to master

[msaroufim]

there's some more validaiton we can do

• Ensure the url is using the https protocol and not http or ftp
• Potentially check that the IP is not a litteral IP and instead a domain?
• Limit redirections
• ..%2F is used for path traveral attacks
• Optionally some additional checks on user-agent and content-type

[lxning]

these validation is covered by function validateURL