check uses of URI.resolve

[loosebazooka]

URI resolve works right now in sigstore-java because of how we distribute our base urls, but that could change. We should either write a custom handler or look deeper into how to fortify this a bit.