Backport #35177, #35183
Auto-redirect for in-site links, and show 404 for external links (to avoid open redirect or phishing)