fix: validate only URL path and query, not full URL with protocol

Modified URL validation to check only the path and query string parts
of the URL, excluding the protocol and host. This prevents false
positives from the https:// protocol being matched against patterns
like "file://" that are meant to detect malicious URLs.

The security middleware now correctly distinguishes between the safe
HTTPS protocol and actual suspicious patterns in the request path.

src/api/middleware/security.py

@@ -254,13 +254,18 @@ class RequestValidator:
         if len(url) > SecurityConfig.MAX_URL_LENGTH:
             return False, "URL too long"
         
-        # Check for suspicious patterns in URL
+        # Only check path and query for suspicious patterns, not the full URL
+        path_and_query = request.url.path
+        if request.url.query:
+            path_and_query += "?" + request.url.query
+            
+        # Check for suspicious patterns in path and query only
         for pattern in self.suspicious_patterns:
-            if pattern.search(url):
+            if pattern.search(path_and_query):
                 return False, "Suspicious pattern in URL"
         
         # Check for double encoding
-        if "%25" in url:
+        if "%25" in path_and_query:
             return False, "Double URL encoding detected"
         
         return True, None