fix(desktop): apply linked server proxy headers and certificate exception to WebSockets (#1670)

* fix(desktop): send linked server proxy headers on WebSocket upgrades

isLinkedOrigin compared the request origin with the link's http(s)
origin, so the terminal WebSocket (wss://host/...) never matched and its
upgrade went out without the proxy headers and basic auth. Behind a
forward-auth proxy that upgrade was redirected to the login and the
terminal closed with "connection closed unexpectedly". ws and wss now
count as http and https for the comparison, the same mapping the
WebSocket handshake itself uses, with host and port still matched
exactly.

* fix(desktop): allow a linked server's self-signed certificate for its WebSockets

isInvalidCertificateAllowedForUrl compared the URL with a local
getOrigin copy, so wss://host never matched the link's https://host
origin and an allowed self-signed certificate did not cover the
terminal and tunnel sockets. It now uses linkedServer.isLinkedOrigin,
which maps ws and wss the same way as the proxy headers, and the local
copy is removed.

electron/linked-server.cjs

@@ -6,9 +6,16 @@
 
 let linked = null;
 
+const WEBSOCKET_TO_HTTP = { "ws:": "http:", "wss:": "https:" };
+
+// A WebSocket to the linked server (wss://host/...) counts as the link's
+// https://host origin, so its upgrade carries the proxy headers too.
 function getOrigin(url) {
   try {
-    return new URL(url).origin;
+    const parsed = new URL(url);
+    const httpProtocol = WEBSOCKET_TO_HTTP[parsed.protocol];
+    if (httpProtocol) parsed.protocol = httpProtocol;
+    return parsed.origin;
   } catch {
     return null;
   }

electron/main.cjs

@@ -442,14 +442,6 @@ function isInsecureModeEnabled() {
   );
 }
 
-function getOrigin(url) {
-  try {
-    return new URL(url).origin;
-  } catch {
-    return null;
-  }
-}
-
 function isPrivateNetworkHost(hostname) {
   if (
     hostname === "localhost" ||
@@ -493,7 +485,7 @@ function isInvalidCertificateAllowedForUrl(url) {
   // allows a self-signed certificate.
   const linked = linkedServer.getLinkedServer();
   if (!linked?.allowInvalidCertificate) return false;
-  return getOrigin(url) === linked.origin;
+  return linkedServer.isLinkedOrigin(url);
 }
 
 function getTlsVerificationOptions(url) {