fix(request): strip credentials on cross-origin redirects

[miinimes1]

Motivation

tempo request -L manually follows redirects and copied request headers unchanged. A cross-origin redirect could therefore forward Authorization, Cookie, or Proxy-Authorization to the redirect target.

Summary

• Strip credential-bearing headers when a redirect changes origin
• Preserve credentials for same-origin redirects
• Add regression coverage for both cases
• Add a patch changelog entry

Validation

• pnpm check:lint
• pnpm check:types
• pnpm test:types
• pnpm changelog:validate
• pnpm vitest run test/request.test.ts -t "(strips credentials|preserves credentials)"