AX-29019: Implement client wildcard redirectURI support

[michaelliau]

Overview

There are two major changes in this PR.

1. The Flock Freight fork brought up-to-date by rebasing from dexidp/dex:master.
2. Wildcard support for client redirectURIs is implemented.

Wildcard support was raised in this issue: dexidp#448

This change is inspired by dexidp#1220 and dexidp#1783, but implements the same approach that Okta takes for wildcard redirectURIs.

Description

Using wildcards for redirectURIs introduces a security risk in production environments and should be used with caution in non-production environments only. In development environments, the use of wildcards allows for simpler management of Dex and client application deployments.

Wildcard support has been limited to the following rules, which are taken from Okta's implementation of the same feature:

• Any configured redirect URIs may contain a single * character in the lowest-level domain (for example, https://redirect-*-domain.example.com/oidc/redirect) to act as a wildcard.
• The wildcard subdomain must have at least one subdomain between it and the top level domain.
• The wildcard can match any valid hostname characters, but can’t span more than one domain. For example, if https://redirect-*-domain.example.com/oidc/redirect is configured as a redirect URI, then https://redirect-1-domain.example.com/oidc/redirect and https://redirect-sub-domain.example.com/oidc/redirect match, but https://redirect-1.sub-domain.example.com/oidc/redirect doesn’t match.
• Only the https URI scheme can use wildcard redirect URIs.