Keep a link preview's link and image off this Campfire's own host

A preview belongs to the page it previews, so both URLs point somewhere
else. An absolute URL on our own host passed the scheme and host checks,
and every reader's browser fetched it with their session attached, which
turns a message into a GET request made on the reader's behalf.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0186eyzivcTn6wqjEE4Wnxdt

lib/rails_ext/actiontext_opengraph_embeds.rb

@@ -23,20 +23,25 @@ class ActionText::Attachment::OpengraphEmbed
         }
       end
 
-      # A link preview points at what we unfurled, which is always an absolute
-      # http or https URL naming a host. Drop anything else the message body asks
-      # for, so a body written by hand can't aim the preview's link or its image at
-      # another scheme or at a path on this Campfire. A URL like "https:/rooms/1"
-      # needs the host check as well as the scheme one: Ruby parses it as HTTPS,
-      # and a browser resolves it against whatever origin Campfire is served from.
+      # A link preview points at what we unfurled: an absolute http or https URL
+      # on some other host. Drop anything else a message body asks for, so it
+      # can't aim the preview's link or its image at this Campfire and have every
+      # reader's browser fetch it with their session attached.
       def web_url(value)
         return if value.blank?
 
         parsed = URI.parse(value)
-        value if parsed.is_a?(URI::HTTP) && parsed.host.present?
+        value if parsed.is_a?(URI::HTTP) && elsewhere?(parsed.host)
       rescue URI::InvalidURIError
         nil
       end
+
+      # "https:/rooms/1" parses as HTTPS with no host at all, and a browser
+      # resolves both that and our own hostname against the origin Campfire is
+      # served from.
+      def elsewhere?(host)
+        host.present? && !host.casecmp?(Current.request_host.to_s)
+      end
   end
 
   attr_accessor :href, :url, :filename, :description