fix: external urls validate a scheme and hostname

[untra]

• DEVEX-523

Summary

• coder_app resources with external = true now validate the url at plan time via a new CustomizeDiff in
  provider/app.go, ensuring the URL has both a scheme and a host before apply.
• Adds ValidateExternalURL in provider/helpers/validation.go, matching what a browser or OS URL
  handler would actually accept. Rejects bare host:port strings (which Go's url.Parse misreads as a
  scheme), opaque schemes and malformed urls
  • Increases the timeout of the integration tests for startup in a container 2seconds. this can be controversial; some folks like this tighter.

Why

External app URLs are opened directly by the browser or a custom protocol handler (e.g. vscode://), so
a URL missing a scheme or missing a host (https://) silently fails to open for the user. This catches that at terraform plan time with a clear error instead of a confusing runtime failure.

Testing

• New table-driven tests in provider/helpers/validation_test.go covering valid cases (https, vscode://,
  reverse-DNS custom schemes, jetbrains-gateway://) and invalid cases (host:port without scheme,
  opaque schemes, missing scheme, missing host, malformed URLs).
• New acceptance-style test cases in provider/app_test.go (NoScheme, HostPortWithoutScheme, NoHost,
  NotExternalIsUnchecked) verifying the diff-time check only fires when external = true and unknown values (computed at apply) are skipped.
• go test ./provider/... passes.
• Increases the integration test timeout to 12 seconds from 10; was causing ci flake.

tested locally with:
~/.terraformrc :

terraform {
 required_providers {
   coder = {
     source = "coder/coder"
   }
 }
}

provider "coder" {}

resource "coder_agent" "dev" {
 os   = "linux"
 arch = "amd64"
}

resource "coder_app" "bad_external" {
 agent_id     = coder_agent.dev.id
 slug         = "bad-external"
 display_name = "Bad External App"
 url          = "localhost:8080"
 external     = true
}

main.tf (intentionally broken missing scheme) :

  terraform {
  required_providers {
    coder = {
      source = "coder/coder"
    }
  }
}

provider "coder" {}

resource "coder_agent" "dev" {
  os   = "linux"
  arch = "amd64"
}

resource "coder_app" "bad_external" {
  agent_id     = coder_agent.dev.id
  slug         = "bad-external"
  display_name = "Bad External App"
  url          = "localhost:8080"
  external     = true
}

[linear-code]

DEVEX-523

[matifali]

A few nits, but it looks good to me.

[matifali]

shouldn't this be "localhost" URLs must include a scheme

[matifali]

must include a scheme and a host

[aslilac]

I think this function probably needs to live in coder/coder somewhere so that...

• we can also validate it on the backend somewhere around here: https://github.com/coder/coder/blob/78b5fdf0ab378f315521c05c6af038e859c3abf5/provisioner/terraform/resources.go#L501
• the validations stay in sync across changes