fix(frontend): URL substring sanitazion issue (#11232)

Potential fix for
[https://github.com/Significant-Gravitas/AutoGPT/security/code-scanning/145](https://github.com/Significant-Gravitas/AutoGPT/security/code-scanning/145)

To fix the issue, rather than using substring matching on the raw URL
string, we need to properly parse the URL and inspect its hostname. We
should confirm that the `hostname` property of the parsed URL is equal
to either `vimeo.com` or explicitly permitted subdomains like
`www.vimeo.com`. We can use the native JavaScript `URL` class for robust
parsing.

**File/Location:**  
- Only change line(s) in
`autogpt_platform/frontend/src/app/(platform)/library/agents/[id]/components/AgentRunsView/components/OutputRenderers/renderers/MarkdownRenderer.tsx`
- Specifically, update the logic in function `isVideoUrl()` on line 45.

**Methods/Imports/Definitions:**  
- Use the standard `URL` class (no need to add a new import, as this is
available in browsers and in Node.js).
- Provide fallback in case the URL passed in is malformed (wrap in a
try-catch, treat as non-video in this case).
- Check the parsed hostname for equality with `vimeo.com` or,
optionally, specific allowed subdomains (`www.vimeo.com`).

---


_Suggested fixes powered by Copilot Autofix. Review carefully before
merging._

---------

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

autogpt_platform/frontend/src/app/(platform)/library/agents/[id]/components/AgentRunsView/components/OutputRenderers/renderers/MarkdownRenderer.tsx

@@ -42,8 +42,16 @@ function isVideoUrl(url: string): boolean {
   if (url.includes("youtube.com/watch") || url.includes("youtu.be/")) {
     return true;
   }
-  if (url.includes("vimeo.com/")) {
-    return true;
+  try {
+    const parsed = new URL(url);
+    if (
+      parsed.hostname === "vimeo.com" ||
+      parsed.hostname === "www.vimeo.com"
+    ) {
+      return true;
+    }
+  } catch {
+    // If URL parsing fails, treat as not a Vimeo URL.
   }
   return videoExtensions.some((ext) => url.toLowerCase().includes(ext));
 }