fix(security): unify SFX redirect policy across modes (closes #585)

[s2x]

Description

Closes #585

HTTPS→HTTP downgrade redirects were blocked only when --insecure was passed; the default path handed redirect following to PHP's http wrapper, which follows a downgrade to plain HTTP without complaint. The hardening was attached to the wrong branch.

Changes

• Unified redirect policy: all SFX downloads now go through the manual redirect loop; `` controls only TLS peer verification
• follow_location => 0 in both modes: PHP's http wrapper never follows a redirect on the bundle's behalf
• Scheme checks on every hop: HTTPS→HTTP downgrades and any non-HTTP(S) redirect target (file://, php://, ftp://) are blocked from every origin scheme
• resolveRedirectUrl() hardened: unresolvable base URLs and non-HTTP(S) absolute locations throw instead of passing through; protocol-relative locations resolve correctly
• Case-insensitive scheme matching: mixed-case HTTP:///HTTPS:// URLs and Location headers cannot bypass the policy
• Download size cap: 256 MiB by default (SfxDownloader::__construct($maxDownloadBytes)); oversized downloads abort and remove the partial file
• Checksum verified before extraction: the downloaded artifact is verified before ZipArchive runs; for .zip URLs the checksum now covers the zip artifact
• writeStream(): short writes are detected and the partial artifact is cleaned up
• docs/security.md + docs/build-packaging.md: describe the unified policy
• Tests: unit + E2E (local PHP built-in server) covering downgrade rejection in both modes, non-HTTP(S) schemes from both origins, 5-hop limit, size cap, checksum-before-extraction ordering, mixed-case schemes, protocol-relative resolution

Changelog

Entry added under [Unreleased] → Security.

Code Review

• Passed subagent code review (2 rounds; blocker found in round 1 and fixed)
• All review comments addressed