Fix security.require-https by marking redirect as external

Summary:
Resolves T5937.  HTTPS redirects caused by `security.require-https` use a full scheme, domain and port in the URI.  Consequently, this causes invocation of the new external redirect logic and prevents redirection from occurring properly when accessing the HTTP version of Phabricator that has `security.require-https` turned on.

I've also fixed the automatic slash redirection logic to add the external flag where appropriate.

Test Plan: Configured SSL on my local machine and turned on `security.require-https`.  Observed the "Refusing to redirect" exception on master, while the redirect completed successfully with this patch.

Reviewers: #blessed_reviewers, epriestley

Reviewed By: #blessed_reviewers, epriestley

Subscribers: epriestley, Korvin

Maniphest Tasks: T5937

Differential Revision: https://secure.phabricator.com/D10318

src/applications/base/controller/PhabricatorRedirectController.php

@@ -3,6 +3,7 @@
 final class PhabricatorRedirectController extends PhabricatorController {
 
   private $uri;
+  private $allowExternal;
 
   public function shouldRequireLogin() {
     return false;
@@ -14,10 +15,13 @@ final class PhabricatorRedirectController extends PhabricatorController {
 
   public function willProcessRequest(array $data) {
     $this->uri = $data['uri'];
+    $this->allowExternal = idx($data, 'external', false);
   }
 
   public function processRequest() {
-    return id(new AphrontRedirectResponse())->setURI($this->uri);
+    return id(new AphrontRedirectResponse())
+      ->setURI($this->uri)
+      ->setIsExternal($this->allowExternal);
   }
 
 }