Open redirect on app.hey.com bypasses HEY desktop's internal-origin allowlist and loads attacker content inside a HEY BrowserWindow

`app.hey.com/proxy_image` compares the URL scheme case-sensitively. `https://` gets signed and proxied correctly. `HTTPS://` isn't recognised, so instead of proxying it, the endpoint 302s the visitor to the raw URL. No authentication needed.

curl -sI "https://app.hey.com/proxy_image/HTTPS%3A%2F%2Fexample.com%2F"

HTTP/2 302
location: HTTPS://example.com/