urls cleanup: Fix buggy isUrlOnRealm function

[chrisbobbe]

I'm doing a cleanup of some relevant parts of our URL parsing logic, as I prepare for #5306. Inheriting priority from that.

From start to finish, this would take us from

// TODO: Work out what this does, write a jsdoc for its interface, and
// reimplement using URL object (not just for the realm)
export const isUrlOnRealm = (url: string, realm: URL): boolean =>
  url.startsWith('/') || url.startsWith(realm.toString()) || !/^(http|www.)/i.test(url);

to

// TODO: As of writing, we use this same check in 5 or so other places.
//   Probably should consolidate those so they call this function, or else
//   dissolve this function.
export const isUrlOnRealm = (url: URL, realm: URL): boolean => url.origin === realm.origin;

(Ah, and I think the TODO we're left with in the "after" is probably something we can resolve easily.)

Rather than making that big change in one commit, I've tried to pull out incremental changes so we can see how the behavior changes. As always, please let me know if you'd like me to be more or less incremental, or if there's a better order I can put the commits in. 🙂

[chrisbobbe]

Ah, self-nit: one identified false negative remains in this commit (see code comment below), so don't remove this whole TODO just yet.

[gnprice]

Thanks again @chrisbobbe for this fix and spotting the consequences of the issue!

I've now pushed f36ccd7 to main, which is a cherry-pick of the stripped-down bugfix that went into release v27.190. So the next step for this PR would be to rebase atop that. The refactors that are in this branch correspond well with what's described in that commit message:

This still isn't a great structure, because it'd be easy for a call
site to change (or a new one to be added) so that the URL gets used
in a way other than by passing to our `new URL`, or with a different
base URL.  Add a TODO to refactor accordingly, and mark the function
as deprecated to discourage new callers.

[chrisbobbe]

Closing as superseded by #5492.