fix: external urls validate a scheme and hostname

[untra]

• DEVEX-523

Summary

• coder_app resources with external = true now validate the url at plan time via a new CustomizeDiff in
  provider/app.go, ensuring the URL has both a scheme and a host before apply.
• Adds ValidateExternalURL in provider/helpers/validation.go, matching what a browser or OS URL
  handler would actually accept. Rejects bare host:port strings (which Go's url.Parse misreads as a
  scheme), opaque schemes and malformed urls
  • Increases the timeout of the integration tests for startup in a container 2seconds. this can be controversial; some folks like this tighter.

Why

External app URLs are opened directly by the browser or a custom protocol handler (e.g. vscode://), so
a URL missing a scheme or missing a host (https://) silently fails to open for the user. This catches that at terraform plan time with a clear error instead of a confusing runtime failure.

Testing

• New table-driven tests in provider/helpers/validation_test.go covering valid cases (https, vscode://,
  reverse-DNS custom schemes, jetbrains-gateway://) and invalid cases (host:port without scheme,
  opaque schemes, missing scheme, missing host, malformed URLs).
• New acceptance-style test cases in provider/app_test.go (NoScheme, HostPortWithoutScheme, NoHost,
  NotExternalIsUnchecked) verifying the diff-time check only fires when external = true and unknown values (computed at apply) are skipped.
• go test ./provider/... passes.

[linear-code]

DEVEX-523