Potential fix for code scanning alert no. 4: URL redirection from remote source

[Joe-Heffer-Shef]

Potential fix for https://github.com/RSE-Sheffield/SORT/security/code-scanning/4

To fix this issue, we need to validate the value of request.META["HTTP_REFERER"] before using it as the redirect target. The best way to do this in Django is to use the built-in utility function django.utils.http.url_has_allowed_host_and_scheme, which determines whether the URL is safe for redirection (i.e., it uses an allowed host and scheme). We should replace the current usage so that if the REFERER is allowed, we redirect to it; otherwise, we should redirect to a safe default such as the survey improvement plan page (as currently coded).

Required changes:

• Import url_has_allowed_host_and_scheme from django.utils.http, if not already imported.
• Change the redirect logic in SurveyImprovementPlanUpdateView.post so that before redirecting to the REFERER, we check if it is allowed using the function above.
• If the REFERER is not allowed, redirect to the default URL (as in the current fallback).

---

Suggested fixes powered by Copilot Autofix. Review carefully before merging.