fix: strip Host on cross-origin redirects

[ryanfowler]

Summary

• strip explicit Host headers when following cross-origin redirects
• allow the transport to regenerate Host from the redirect destination
• preserve custom Host headers for same-origin redirects
• add cross-origin and same-origin regression coverage

Validation

• cargo fmt
• cargo test --locked --all-features --test http cross_origin_redirect_strips_explicit_sensitive_headers
• cargo test --locked --all-features --test http same_origin_redirect_preserves_explicit_host_header