Fixes Incomplete URL substring sanitization vulnerability detected by CodeQL

[Onyx2406]

Description

The fix parse a URL before performing a check on its host value, and ensure that the check handles arbitrary subdomain sequences correctly.

• The statement hostname === 'mifos.io' will check if the hostname is exactly 'mifos.io'.
• The statement domains.slice(-2).join('.') === 'mifos.io' will check if the last two parts of the hostname (split by '.') are 'mifos.io'.
• Also, the updated code doesn't use indexOf anymore and therefore is not vulnerable to URL spoofing attacks that were possible with the original code.
• It uses the endsWith method to check if the hostname ends with 'mifos.io'.

Related issues and discussion

#3520

Screenshots, if any

Checklist

Please make sure these boxes are checked before submitting your pull request - thanks!

• [] Validate the JS and HTML files with grunt validate to detect errors and potential problems in JavaScript code.
  giving network error "grunt validate" giving network error #3519

• [] Run the tests by opening test/SpecRunner.html in the browser to make sure you didn't break anything.

• If you have multiple commits please combine them into one commit by squashing them.

• Read and understood the contribution guidelines at community-app/Contributing.md.