Fix newView link to use context-relative URL instead of rootURL

[sahilleth]

Fixes #22743

What was done

The "New View" link in the view tab bar used ${rootURL} which produces an absolute URL. When Jenkins is behind a reverse proxy (e.g. nginx) with Root URL set to the internal server for agent connectivity, clicking "New View" redirected users to the internal URL instead of staying on the proxy URL.

Fix: Use ${request.contextPath}/${currentView.owner.url}newView instead of ${rootURL}/${currentView.owner.url}newView. This produces a path-absolute URL (e.g. /jenkins/newView or /jenkins/job/foo/newView) that the browser resolves against the current origin (the proxy URL), while still correctly targeting the owning ViewGroup's newView for root, folders, and My Views.

This also addresses SECURITY-1471 by removing rootURL from the link, preventing javascript: injection via Root URL configuration.

Testing done

• Changed files: DefaultViewsTabBar/viewTabs.jelly, DefaultMyViewsTabBar/myViewTabs.jelly
• Existing test JenkinsLocationConfigurationTest#cannotInjectJavaScriptUsingRootUrl_inNewViewLink validates that the newView link does not use rootURL for XSS; this change strengthens that by not using rootURL at all
• Manual verification: Links now use path-relative format that resolves to current host

Proposed changelog entries

• Make the "New View" link use a context-relative URL so it works correctly when Jenkins is behind a reverse proxy with Root URL configured for internal agent connectivity

Proposed changelog category

/label bug

Submitter checklist

• The issue is well-described
• Changelog entry is in imperative mood
• Existing SECURITY-1471 test covers the change
• No new public APIs
• No CSP impact (Jelly template change only)

[sahilleth]

CI is green after updating href handling. Please let me know if further adjustments are needed.

[daniel-beck]

The "New View" link in the view tab bar used ${rootURL} which produces an absolute URL.

No:

jenkins/core/src/main/java/hudson/Functions.java

Lines 299 to 306 in 057aa6a

	String rootURL = currentRequest.getContextPath();
	Functions h = new Functions();
	context.setVariable("h", h);
	// The path starts with a "/" character but does not end with a "/" character.
	context.setVariable("rootURL", rootURL);

This PR does nothing.