Harden redirect handling: strip sensitive headers cross-origin and restrict redirect schemes

The desktop request engine lets libcurl follow redirects internally, and libcurl sends custom HTTPHEADER headers to every redirect target, including cross-origin hosts. It only withholds Authorization and Cookie. Insomnia follows redirects by default, so a server that redirects can receive secret custom headers such as API keys that were meant for the original host.

I also noticed redirect targets were never restricted by scheme. The file:// guard only checks the initial URL, so a redirect to file://, gopher://, or ftp:// was left to libcurl.

What I think should change:

Walk redirects hop by hop, and drop credential, cookie, and custom headers before a cross-origin hop. Same-origin hops keep working as before, and safe headers like Accept travel untouched.

Clear origin-bound auth (digest, NTLM, netrc) on cross-origin hops.

Record followed redirects and stripped headers in the timeline so the chain stays visible.

Only allow http and https redirect targets.

I have a PR ready that does this for the main send path, with tests. The realtime streaming path still uses libcurl internal following and would need a separate pass.