[dostu]

What this PR does

Follow-up to #2078. safe_embedded_app_url still lets a dotless host through:

• deduced_phishing_attack? validates with ShopifyApp::Utils.sanitize_shop_domain, which appends the myshopify domain when the value has no dot, so 134744072 passes as 134744072.myshopify.com.
• The redirect is built from the original value: https://134744072/apps/<api_key>.
• Browsers read 134744072 (and 0x08080808) as the IPv4 address 8.8.8.8, and decode evil%2ecom or evil。com (ideographic full stop) to evil.com. So the generated home controller redirects to an arbitrary IP or domain from the app's domain.

unsafe_embedded_host? now also rejects a host whose authority has no dot. Real hosts (admin.shopify.com/store/<shop>, <shop>.myshopify.com/admin, spin/dev domains) always have one.

Reviewer's guide to testing

• test/controllers/concerns/embedded_app_test.rb: the two new tests (numeric host, percent-encoded dot) fail on main (redirects to https://134744072/... and https://evil%2ecom/...) and pass with the fix. Full suite green.
• Checked in Chrome against an app on 23.0.3 using the generated home controller: before, the redirect opened https://8.8.8.8/...; with this branch it goes to the root URL, and admin.shopify.com/store/<shop> still redirects into the admin.
• On main host=base64("evil%2ecom") redirects to https://evil%2ecom/apps/..., which Chrome opens as https://evil.com/apps/...; with this branch it goes to the root URL.

Things to focus on

1. lib/shopify_app/controller_concerns/embedded_app.rb: the dotless check sits next to the userinfo check from Improve host validation #2078.

Checklist

• Update CHANGELOG.md if the changes would impact users
• Update README.md, if appropriate.
• Update any relevant pages in /docs, if necessary
• For security fixes, the Disclosure Policy must be followed. Open redirects without further impact are ineligible in the HackerOne program, so this is filed as a hardening PR, like Improve host validation #2078.

[dostu]

I have signed the CLA!