Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header

{
                    "vendor": "tektoncd",
                    "product": "pipelines-as-code",
                    "versions": [
                        {
                            "version": "< 0.37.8",
                            "status": "affected"
                        },
                        {
                            "version": ">= 0.38.0, < 0.39.6",
                            "status": "affected"
                        },
                        {
                            "version": ">= 0.40.0, < 0.42.1",
                            "status": "affected"
                        },
                        {
                            "version": ">= 0.43.0, < 0.48.0",
                            "status": "affected"
                        }
                    ]
                }