Refactor OpenAPI handling and update samples

[RolandGuijt]

Summary

• Refactored ProxyingOpenApiDocument for better readability and maintainability.
• Updated OpenAPI document writer to handle asynchronous JSON serialization.
• Added inline comments to address potential future compatibility issues with OpenAPI library and .NET 10.
• Fixed missing reference in the project.
• Updated tokenexchange sample to ensure functionality.
• Performed general updates on samples for consistency and compatibility.

In general, to fix this type of problem you should not directly trust text/attributes taken from the DOM when using them in sensitive operations (HTML insertion, script execution, navigation). Instead, sanitize and validate the value, and constrain it to a safe set of destinations (e.g., same-origin paths or a whitelist of allowed hosts). If the value is meant to be a simple path, restrict it to that; if it's a full URL, parse it and enforce origin checks before using it.

For this specific file, the best fix with minimal functional change is:

1. Read the data-url attribute into a variable.
2. Parse it using the standard URL constructor to ensure it is syntactically valid and to inspect its origin.
3. Enforce that the destination is same-origin (or otherwise constrained) before assigning to window.location.href. If it fails validation, do not redirect (or optionally fall back to a safe default like /).

This keeps the existing behavior for legitimate same-origin URLs while preventing navigation to arbitrary attacker-controlled destinations. No external libraries are needed; the built-in URL API is sufficient. All changes are confined to BFF/v4/TokenExchange/TokenExchange.IdentityServer/wwwroot/js/signin-redirect.js line 1, expanding it into a small, explicit redirect routine.