Require a host on a link preview's link and image

Ruby parses "https:/rooms/1" as an HTTPS URL with no host, and a browser
resolves it against whatever origin Campfire is served from, so the scheme
check alone still let a message body aim the preview at a path here.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0186eyzivcTn6wqjEE4Wnxdt

lib/rails_ext/actiontext_opengraph_embeds.rb

@@ -24,11 +24,16 @@ class ActionText::Attachment::OpengraphEmbed
       end
 
       # A link preview points at what we unfurled, which is always an absolute
-      # http or https URL. Drop anything else the message body asks for, so a
-      # body written by hand can't aim the preview's link or its image at another
-      # scheme or at a path on this Campfire.
+      # http or https URL naming a host. Drop anything else the message body asks
+      # for, so a body written by hand can't aim the preview's link or its image at
+      # another scheme or at a path on this Campfire. A URL like "https:/rooms/1"
+      # needs the host check as well as the scheme one: Ruby parses it as HTTPS,
+      # and a browser resolves it against whatever origin Campfire is served from.
       def web_url(value)
-        value if value.present? && URI.parse(value).is_a?(URI::HTTP)
+        return if value.blank?
+
+        parsed = URI.parse(value)
+        value if parsed.is_a?(URI::HTTP) && parsed.host.present?
       rescue URI::InvalidURIError
         nil
       end