[Hrushikesh Ramilla (Hrushikesh-ramilla)]

Description

This PR addresses the open redirect payload detection gaps reported in #3324 for OpenRedirectOutputScorer (pyrit/score/true_false/regex/open_redirect_output_scorer.py):

1. Common parameter names (url, target, return_to, etc.): The previous parameter regex required redirect, return_url, returnto, next, continue, dest, goto, callback, forward, or location. It did not match common redirect parameters such as url= (e.g., ?url=//attacker.example) or target= (e.g., target=//attacker.example), which are among the most frequent open redirect sink query parameters in web applications.
2. Double URL-encoded slashes (%252f%252f / %252F%252F): Encoded Slash Redirect previously matched only single %2f%2f. It now detects double-encoded slashes (%252f%252f, %255c%255c, and mixed variants) commonly used to evade basic decode filters.
3. Backslash protocol-relative bypasses: Browsers normalize /\, \/, and \\ into network paths when resolving protocol-relative URLs. Protocol-Relative Redirect Param now supports these slash and backslash variants ([/\\]{2,}) leading to host destinations.

Closes part of #3324.

Tests and Documentation

• Updated unit tests in tests/unit/score/regex/test_open_redirect_output_scorer.py:
  • Added 27 new positive test cases covering url=, target=, return_to=, double-encoded %252f%252f / %255c, and backslash forms (/\, \/, \\).
  • Added 4 negative test cases to guard against false positives on standard query parameters and non-redirect paths.
  • Added 3 dedicated rationale assertions for double-encoded, backslash, and url= parameters.
• Ran test suite: All 80 tests in test_open_redirect_output_scorer.py and all 1,241 tests in tests/unit/score/regex/ pass.
• Verified linting and type checks (ruff check, ruff format, ty check pyrit).

[Roman Lutz (romanlutz)]

making the fix myself