fix: Add stricter URL validation to openURLMiddleware

[huntie]

Summary

References

• OS command injection on windows when opening urls sindresorhus/open#323
• https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/start

Test Plan

Invalid URL

✅ Blocked

Sanity check — regular URL

✅ OK
✅ Opens web browser

Checklist

• Documentation is up to date.
• Follows commit message convention described in CONTRIBUTING.md.
• For functional changes, my test plan has linked these CLI changes into a local react-native checkout (instructions).

[thymikee]

Thanks! Feel free to merge

[huntie]

d003eab: Remove {appName: 'browser'} argument — led to a no-op in local testing on a macOS system.