fix: validate URLs before shell.openExternal

[enlomy]

Requirements

• Restrict which URLs the app may hand to the OS / browser via shell.openExternal, so non-http(s) schemes (e.g. file:, javascript:) are not opened from IPC or from in-window navigation.

Changes

• Added openExternalIfAllowed(url) in electron/main.cjs to parse the URL and allow only http: and https: before calling shell.openExternal.

Testing Notes

• Ran npm run lint and npm run build:app locally
• I tested it by changing the Bitwarden support link to 'file:///Users/you/Desktop/bitwarden-help.pdf'
  I have attached a screen recording file

Things reviewers should pay attention to

• Ran npm run lint and npm run build:app locally (or: pre-commit passed).

Screenshots/Recordings

test.case.mov

dependencies

• None.